API accepts requests without a valid token when authentication is enabled and role-based authorization is disabled #5986

Symptoms

When authentication is enabled and role-based authorization is disabled, the ServiceControl error, audit and monitoring instances accept API requests without a bearer token, with an invalid token, or with an expired token. The request runs as if a signed-in user sent it.

Who's affected

Users of ServiceControl 6.18.0 to 6.21.1 who have Authentication.Enabled set to true and Authentication.RoleBasedAuthorizationEnabled set to false (the default).

Instances with authentication disabled are not affected. These instances do not require a token by design. Instances with role-based authorization enabled are not affected.

Root cause

Every API action has a permission policy. With role-based authorization disabled, each permission policy allowed every request and did not require an authenticated user. ASP.NET Core only applies the fallback policy, which requires an authenticated user, to endpoints without a policy. So no policy required authentication on the API actions.

Confirmed workarounds

Enable role-based authorization on every instance. Before you enable it, make sure that the identity provider assigns a role to every user. Users without a role are denied access.

Backported to

• 6.21.2