From 1acd690299b971c1f092e6ae843c922b7d0b4337 Mon Sep 17 00:00:00 2001 From: Jeff Mitchell Date: Mon, 12 Oct 2020 10:15:38 -0400 Subject: [PATCH] Clear account ID if token does not map to a user It's possible there are acceptable use cases for still matching account ID if the account no longer maps to a user, but it's equally possible that this can cause confusion. Removing it seems safer. --- internal/auth/auth.go | 1 + 1 file changed, 1 insertion(+) diff --git a/internal/auth/auth.go b/internal/auth/auth.go index 02fae261e..c7788a60d 100644 --- a/internal/auth/auth.go +++ b/internal/auth/auth.go @@ -327,6 +327,7 @@ func (v verifier) performAuthCheck() (aclResults perms.ACLResults, userId string if userId == "" { v.logger.Warn("perform auth check: valid token did not map to a user, likely because no account is associated with the user any longer; continuing as u_anon", "token_id", at.GetPublicId()) userId = "u_anon" + accountId = "" } } }