Synthesize anonymous token pre-bootstrap when needed (#16200)

* add bootstrapping detail for acl errors

* error detail improvements

* update acl bootstrapping test coverage

* update namespace errors

* update test coverage

* consolidate error message code and update changelog

* synthesize anonymous token

* Update token language to distinguish Accessor and Secret ID usage (#16044)

* remove legacy tokens

* remove lingering legacy token references from docs

* update language and naming for token secrets and accessor IDs

* updates all tokenID references to clarify accessorID

* remove token type references and lookup tokens by accessorID index

* remove unnecessary constants

* replace additional tokenID param names

* Add warning info for deprecated -id parameter

Co-authored-by: Paul Glass <pglass@hashicorp.com>

* Update field comment

Co-authored-by: Paul Glass <pglass@hashicorp.com>

---------

Co-authored-by: Paul Glass <pglass@hashicorp.com>

* revert naming change

* add testing

* revert naming change

---------

Co-authored-by: Paul Glass <pglass@hashicorp.com>

acl/acl.go

@@ -8,6 +8,7 @@ const (
 	// to convert this to AnonymousTokenAlias.
 	AnonymousTokenID     = "00000000-0000-0000-0000-000000000002"
 	AnonymousTokenAlias  = "anonymous token"
+	AnonymousTokenSecret = "anonymous"
 )
 
 // Config encapsulates all of the generic configuration parameters used for

agent/consul/acl_server.go

@@ -148,6 +148,16 @@ func (s *Server) ResolveIdentityFromToken(token string) (bool, structs.ACLIdenti
 	} else if aclToken != nil && !aclToken.IsExpired(time.Now()) {
 		return true, aclToken, nil
 	}
+	if aclToken == nil && token == acl.AnonymousTokenSecret {
+		// synthesize the anonymous token for early use, bootstrapping has not completed
+		s.InsertAnonymousToken()
+		fallbackId := structs.ACLToken{
+			AccessorID:  acl.AnonymousTokenID,
+			SecretID:    acl.AnonymousTokenSecret,
+			Description: "synthesized anonymous token",
+		}
+		return true, &fallbackId, nil
+	}
 
 	defaultErr := acl.ErrNotFound
 	canBootstrap, _, _ := s.fsm.State().CanBootstrapACLToken()

agent/consul/leader.go

@@ -506,6 +506,32 @@ func (s *Server) initializeACLs(ctx context.Context) error {
 		}
 
 		// Insert the anonymous token if it does not exist.
+		if err := s.InsertAnonymousToken(); err != nil {
+			return err
+		}
+
+		// Generate or rotate the server management token on leadership transitions.
+		// This token is used by Consul servers for authn/authz when making
+		// requests to themselves through public APIs such as the agent cache.
+		// It is stored as system metadata because it is internally
+		// managed and users are not meant to see it or interact with it.
+		secretID, err := lib.GenerateUUID(nil)
+		if err != nil {
+			return fmt.Errorf("failed to generate the secret ID for the server management token: %w", err)
+		}
+		if err := s.setSystemMetadataKey(structs.ServerManagementTokenAccessorID, secretID); err != nil {
+			return fmt.Errorf("failed to persist server management token: %w", err)
+		}
+	} else {
+		s.startACLReplication(ctx)
+	}
+
+	s.startACLTokenReaping(ctx)
+
+	return nil
+}
+
+func (s *Server) InsertAnonymousToken() error {
 	state := s.fsm.State()
 	_, token, err := state.ACLTokenGetBySecret(nil, anonymousToken, nil)
 	if err != nil {
@@ -532,25 +558,6 @@ func (s *Server) initializeACLs(ctx context.Context) error {
 		}
 		s.logger.Info("Created ACL anonymous token from configuration")
 	}
-
-		// Generate or rotate the server management token on leadership transitions.
-		// This token is used by Consul servers for authn/authz when making
-		// requests to themselves through public APIs such as the agent cache.
-		// It is stored as system metadata because it is internally
-		// managed and users are not meant to see it or interact with it.
-		secretID, err := lib.GenerateUUID(nil)
-		if err != nil {
-			return fmt.Errorf("failed to generate the secret ID for the server management token: %w", err)
-		}
-		if err := s.setSystemMetadataKey(structs.ServerManagementTokenAccessorID, secretID); err != nil {
-			return fmt.Errorf("failed to persist server management token: %w", err)
-		}
-	} else {
-		s.startACLReplication(ctx)
-	}
-
-	s.startACLTokenReaping(ctx)
-
 	return nil
 }
 

api/acl_test.go

@@ -291,14 +291,23 @@ func prepTokenPoliciesInPartition(t *testing.T, acl *ACL, partition string) (pol
 
 func TestAPI_ACLBootstrap(t *testing.T) {
 	t.Parallel()
-	c, s := makeNonBootstrappedACLClient(t)
-	defer s.Stop()
+	c, s := makeNonBootstrappedACLClient(t, "allow")
 
+	s.WaitForLeader(t)
+	// not bootstrapped, default allow
+	mems, err := c.Agent().Members(false)
+	require.NoError(t, err)
+	require.True(t, len(mems) == 1)
+
+	s.Stop()
+	c, s = makeNonBootstrappedACLClient(t, "deny")
 	acl := c.ACL()
 	s.WaitForLeader(t)
-
-	// not bootstrapped
-	_, _, err := acl.TokenList(nil)
+	//not bootstrapped, default deny
+	_, _, err = acl.TokenList(nil)
+	require.EqualError(t, err, "Unexpected response code: 403 (Permission denied: anonymous token lacks permission 'acl:read'. The anonymous token is used implicitly when a request does not specify a token.)")
+	c.config.Token = "root"
+	_, _, err = acl.TokenList(nil)
 	require.EqualError(t, err, "Unexpected response code: 403 (ACL system must be bootstrapped before making any requests that require authorization: ACL not found)")
 	// bootstrap
 	mgmtTok, _, err := acl.Bootstrap()
@@ -309,6 +318,7 @@ func TestAPI_ACLBootstrap(t *testing.T) {
 	require.NoError(t, err)
 	// management and anonymous should be only tokens
 	require.Len(t, toks, 2)
+	s.Stop()
 }
 
 func TestAPI_ACLToken_CreateReadDelete(t *testing.T) {

api/api_test.go

@@ -50,15 +50,15 @@ func makeACLClient(t *testing.T) (*Client, *testutil.TestServer) {
 	})
 }
 
-func makeNonBootstrappedACLClient(t *testing.T) (*Client, *testutil.TestServer) {
+func makeNonBootstrappedACLClient(t *testing.T, defaultPolicy string) (*Client, *testutil.TestServer) {
 	return makeClientWithConfig(t,
 		func(clientConfig *Config) {
-			clientConfig.Token = "root"
+			clientConfig.Token = ""
 		},
 		func(serverConfig *testutil.TestServerConfig) {
 			serverConfig.PrimaryDatacenter = "dc1"
 			serverConfig.ACL.Enabled = true
-			serverConfig.ACL.DefaultPolicy = "deny"
+			serverConfig.ACL.DefaultPolicy = defaultPolicy
 			serverConfig.Bootstrap = true
 		})
 }