eventstream: Handle missing policy documents in event streams (#15495) (

#16177) Fixes #15493 Co-authored-by: Will Nicholson <[email protected]>
hashicorp · Feb 14, 2023 · b1957db · b1957db
1 parent 38e4dc7
commit b1957db
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 1 deletion.
diff --git a/.changelog/15495.txt b/.changelog/15495.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+event stream: Fixed a bug where undefined ACL policies on the request's ACL would result in incorrect authentication errors
+```
diff --git a/nomad/stream/event_broker.go b/nomad/stream/event_broker.go
@@ -275,9 +275,14 @@ func aclObjFromSnapshotForTokenSecretID(aclSnapshot ACLTokenProvider, aclCache *
 	aclPolicies := make([]*structs.ACLPolicy, 0, len(aclToken.Policies))
 	for _, policyName := range aclToken.Policies {
 		policy, err := aclSnapshot.ACLPolicyByName(nil, policyName)
-		if err != nil || policy == nil {
+		if err != nil {
 			return nil, errors.New("error finding acl policy")
 		}
+		if policy == nil {
+			// Ignore policies that don't exist, since they don't grant any
+			// more privilege.
+			continue
+		}
 		aclPolicies = append(aclPolicies, policy)
 	}