synthesize anonymous token

acl/acl.go

@@ -6,8 +6,9 @@ const (
 	// AnonymousTokenID is the AccessorID of the anonymous token.
 	// When logging or displaying to users, use acl.AliasIfAnonymousToken
 	// to convert this to AnonymousTokenAlias.
-	AnonymousTokenID    = "00000000-0000-0000-0000-000000000002"
-	AnonymousTokenAlias = "anonymous token"
+	AnonymousTokenID     = "00000000-0000-0000-0000-000000000002"
+	AnonymousTokenAlias  = "anonymous token"
+	AnonymousTokenSecret = "anonymous"
 )
 
 // Config encapsulates all of the generic configuration parameters used for

agent/consul/acl_server.go

@@ -148,6 +148,16 @@ func (s *Server) ResolveIdentityFromToken(token string) (bool, structs.ACLIdenti
 	} else if aclToken != nil && !aclToken.IsExpired(time.Now()) {
 		return true, aclToken, nil
 	}
+	if aclToken == nil && token == acl.AnonymousTokenSecret {
+		// synthesize the anonymous token for early use, bootstrapping has not completed
+		s.InsertAnonymousToken()
+		fallbackId := structs.ACLToken{
+			AccessorID:  acl.AnonymousTokenID,
+			SecretID:    acl.AnonymousTokenSecret,
+			Description: "synthesized anonymous token",
+		}
+		return true, &fallbackId, nil
+	}
 
 	defaultErr := acl.ErrNotFound
 	canBootstrap, _, _ := s.fsm.State().CanBootstrapACLToken()

agent/consul/leader.go

@@ -506,31 +506,8 @@ func (s *Server) initializeACLs(ctx context.Context) error {
 		}
 
 		// Insert the anonymous token if it does not exist.
-		state := s.fsm.State()
-		_, token, err := state.ACLTokenGetBySecret(nil, anonymousToken, nil)
-		if err != nil {
-			return fmt.Errorf("failed to get anonymous token: %v", err)
-		}
-		// Ignoring expiration times to avoid an insertion collision.
-		if token == nil {
-			token = &structs.ACLToken{
-				AccessorID:     acl.AnonymousTokenID,
-				SecretID:       anonymousToken,
-				Description:    "Anonymous Token",
-				CreateTime:     time.Now(),
-				EnterpriseMeta: *structs.DefaultEnterpriseMetaInDefaultPartition(),
-			}
-			token.SetHash(true)
-
-			req := structs.ACLTokenBatchSetRequest{
-				Tokens: structs.ACLTokens{token},
-				CAS:    false,
-			}
-			_, err := s.raftApply(structs.ACLTokenSetRequestType, &req)
-			if err != nil {
-				return fmt.Errorf("failed to create anonymous token: %v", err)
-			}
-			s.logger.Info("Created ACL anonymous token from configuration")
+		if err := s.InsertAnonymousToken(); err != nil {
+			return err
 		}
 
 		// Generate or rotate the server management token on leadership transitions.
@@ -554,6 +531,36 @@ func (s *Server) initializeACLs(ctx context.Context) error {
 	return nil
 }
 
+func (s *Server) InsertAnonymousToken() error {
+	state := s.fsm.State()
+	_, token, err := state.ACLTokenGetBySecret(nil, anonymousToken, nil)
+	if err != nil {
+		return fmt.Errorf("failed to get anonymous token: %v", err)
+	}
+	// Ignoring expiration times to avoid an insertion collision.
+	if token == nil {
+		token = &structs.ACLToken{
+			AccessorID:     acl.AnonymousTokenID,
+			SecretID:       anonymousToken,
+			Description:    "Anonymous Token",
+			CreateTime:     time.Now(),
+			EnterpriseMeta: *structs.DefaultEnterpriseMetaInDefaultPartition(),
+		}
+		token.SetHash(true)
+
+		req := structs.ACLTokenBatchSetRequest{
+			Tokens: structs.ACLTokens{token},
+			CAS:    false,
+		}
+		_, err := s.raftApply(structs.ACLTokenSetRequestType, &req)
+		if err != nil {
+			return fmt.Errorf("failed to create anonymous token: %v", err)
+		}
+		s.logger.Info("Created ACL anonymous token from configuration")
+	}
+	return nil
+}
+
 func (s *Server) startACLReplication(ctx context.Context) {
 	if s.InPrimaryDatacenter() {
 		return