{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/consul/issues/2528","repository_url":"https://api.github.com/repos/hashicorp/consul","labels_url":"https://api.github.com/repos/hashicorp/consul/issues/2528/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/consul/issues/2528/comments","events_url":"https://api.github.com/repos/hashicorp/consul/issues/2528/events","html_url":"https://github.com/hashicorp/consul/issues/2528","id":191096002,"number":2528,"title":"ACL is being bypassed","user":{"login":"akamalov","id":7885257,"avatar_url":"https://avatars.githubusercontent.com/u/7885257?v=3","gravatar_id":"","url":"https://api.github.com/users/akamalov","html_url":"https://github.com/akamalov","followers_url":"https://api.github.com/users/akamalov/followers","following_url":"https://api.github.com/users/akamalov/following{/other_user}","gists_url":"https://api.github.com/users/akamalov/gists{/gist_id}","starred_url":"https://api.github.com/users/akamalov/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/akamalov/subscriptions","organizations_url":"https://api.github.com/users/akamalov/orgs","repos_url":"https://api.github.com/users/akamalov/repos","events_url":"https://api.github.com/users/akamalov/events{/privacy}","received_events_url":"https://api.github.com/users/akamalov/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-22T19:05:22Z","updated_at":"2016-11-22T19:52:48Z","closed_at":null,"body":"### `consul version` for both Client and Server\r\nClient: `0.7.1`\r\nServer: `0.7.1`\r\n\r\n### `consul info` for both Client and Server\r\nClient:\r\n```\r\n/ # consul info\r\nagent:\r\n        check_monitors = 0\r\n        check_ttls = 0\r\n        checks = 0\r\n        services = 1\r\nbuild:\r\n        prerelease = \r\n        revision = 'a9455cd\r\n        version = 0.7.1\r\nconsul:\r\n        bootstrap = false\r\n        known_datacenters = 1\r\n        leader = true\r\n        leader_addr = 192.168.124.139:8300\r\n        server = true\r\nraft:\r\n        applied_index = 61\r\n        commit_index = 61\r\n        fsm_pending = 0\r\n        last_contact = never\r\n        last_log_index = 61\r\n        last_log_term = 2\r\n        last_snapshot_index = 0\r\n        last_snapshot_term = 0\r\n        latest_configuration = [{Suffrage:Voter ID:192.168.124.139:8300 Address:192.168.124.139:8300} {Suffrage:Voter ID:192.168.124.140:8300 Address:192.168.124.140:8300} {Suffrage:Voter ID:192.168.124.141:8300 Address:192.168.124.141:8300}]\r\n        latest_configuration_index = 1\r\n        num_peers = 2\r\n        protocol_version = 1\r\n        protocol_version_max = 3\r\n        protocol_version_min = 0\r\n        snapshot_version_max = 1\r\n        snapshot_version_min = 0\r\n        state = Leader\r\n        term = 2\r\nruntime:\r\n        arch = amd64\r\n        cpu_count = 8\r\n        goroutines = 71\r\n        max_procs = 8\r\n        os = linux\r\n        version = go1.7.3\r\nserf_lan:\r\n        encrypted = false\r\n        event_queue = 0\r\n        event_time = 2\r\n        failed = 0\r\n        health_score = 0\r\n        intent_queue = 0\r\n        left = 0\r\n        member_time = 3\r\n        members = 3\r\n        query_queue = 0\r\n        query_time = 1\r\nserf_wan:\r\n        encrypted = false\r\n        event_queue = 0\r\n        event_time = 1\r\n        failed = 0\r\n        health_score = 0\r\n        intent_queue = 0\r\n        left = 0\r\n        member_time = 1\r\n        members = 1\r\n        query_queue = 0\r\n        query_time = 1\r\n/ # \r\n```\r\n\r\n### Operating system and Environment details\r\n\r\nNAME=\"Alpine Linux\"\r\nID=alpine\r\nVERSION_ID=3.3.1\r\nPRETTY_NAME=\"Alpine Linux v3.3\"\r\nHOME_URL=\"http://alpinelinux.org\"\r\nBUG_REPORT_URL=\"http://bugs.alpinelinux.org\"\r\n\r\n### Description of the Issue (and unexpected/desired result)\r\n\r\nACL is being bypassed\r\n\r\n### Reproduction steps\r\n\r\nHere is my server.json:\r\n\r\n```\r\n{\r\n        \"server\": true,\r\n        \"datacenter\": \"dc1\",\r\n        \"data_dir\": \"/var/consul\",\r\n        \"encrypt\": \"XXXXXX+7hTuuyxMQyw==\",\r\n        \"log_level\": \"INFO\",\r\n        \"enable_syslog\": false,\r\n        \"disable_remote_exec\": true,\r\n        \"skip_leave_on_interrupt\": true,\r\n        \"ui_dir\": \"/consul/ui\",\r\n        \"ui\": true,\r\n        \"client_addr\": \"0.0.0.0\",\r\n        \"domain\": \"consul\",\r\n        \"verify_incoming\": false,\r\n        \"verify_outgoing\": false,\r\n        \"dns_config\": {\r\n                \"allow_stale\": true,\r\n                \"node_ttl\": \"30s\",\r\n                \"enable_truncate\": true,\r\n                \"only_passing\": true\r\n        },\r\n        \"leave_on_terminate\": true,\r\n        \"rejoin_after_leave\": true,\r\n        \"acl_datacenter\": \"dc1\",\r\n        \"acl_default_policy\": \"deny\",\r\n        \"acl_down_policy\": \"extend-cache\",\r\n        \"acl_master_token\": \"XXXXXXXX-416a-9289-977f9434a9d0\",\r\n        \"acl_token\": \"XXXXXXXX-4632-8ec7-e0c193bbae3c\"\r\n}\r\n```\r\n\r\nAttempting to write without token:\r\n\r\n```\r\n[root@mmaster1 consul]# curl -i -X PUT http://consul1.sdncluster1.consul-ak.marathon.mesos:8500/v1/kv/test/write/value -d 300\r\nHTTP/1.1 200 OK\r\nContent-Type: application/json\r\nDate: Tue, 22 Nov 2016 19:03:30 GMT\r\nContent-Length: 4\r\n\r\ntrue[root@mmaster1 consul]# \r\n```\r\n\r\n...it...goes through even if I have not specified a token. \r\n\r\nList ACL support:\r\n```\r\n[root@mmaster1 consul]# curl http://consul1.sdncluster1.consul-ak.marathon.mesos:8500/v1/acl/list\r\nACL support disabled\r\n[root@mmaster1 consul]# \r\n```\r\n\r\nIs Consul ignoring it's configuration file?"},"comment":{"url":"https://api.github.com/repos/hashicorp/consul/issues/comments/262347160","html_url":"https://github.com/hashicorp/consul/issues/2528#issuecomment-262347160","issue_url":"https://api.github.com/repos/hashicorp/consul/issues/2528","id":262347160,"user":{"login":"slackpad","id":673509,"avatar_url":"https://avatars.githubusercontent.com/u/673509?v=3","gravatar_id":"","url":"https://api.github.com/users/slackpad","html_url":"https://github.com/slackpad","followers_url":"https://api.github.com/users/slackpad/followers","following_url":"https://api.github.com/users/slackpad/following{/other_user}","gists_url":"https://api.github.com/users/slackpad/gists{/gist_id}","starred_url":"https://api.github.com/users/slackpad/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slackpad/subscriptions","organizations_url":"https://api.github.com/users/slackpad/orgs","repos_url":"https://api.github.com/users/slackpad/repos","events_url":"https://api.github.com/users/slackpad/events{/privacy}","received_events_url":"https://api.github.com/users/slackpad/received_events","type":"User","site_admin":false},"created_at":"2016-11-22T19:52:47Z","updated_at":"2016-11-22T19:52:47Z","body":"Hi @akamalov you don't want to specify the `\"acl_token\": \"XXXXXXXX-4632-8ec7-e0c193bbae3c\"` in your config file. That will be used by requests that don't supply their own token."}}
{"actor":{"display_login":"slackpad"}}