ACL with no roles not working in Yokohama

[priyeshm]

Hi, 

I am upgrading my instances from Washington to Yokohama version , in Yokohama I find that ACL without any roles are not working. We have multiple ACL for end user which don't have any roles, as the end users in my instance don't have any roles, can you please let me know is there any workaround or solution for this scenario, is adding public role cause security risk.

Regards

Priyesh

[lulu773]

were you able to find the solution?

[JC Moller]

Any resolution to this issue - did anyone open a ticket with support?

- Jan

[-O-]

This is a new feature in Yokohama, so it is by design.

ACLs that don't contain a role or a security attribute are considered invalid ACLs and are not fulfilled by any user/are failed by any user by default.

In other words you need to fix the ACLs.

[-O-]

In SN doc. Exploring Access Control Lists  it is stated:

Deny by default behavior

By default the ACL engine completely denies access if an ACL is empty or invalid. Empty ACLs are defined as ACLs without one or more of these components:

• Defined role
• Security attribute
• Data condition
• Script

Invalid ACLs are defined as:

• ACLs with roles that do not exist (e.g. have no row in the database)
• ACLs with Security Attributes that do not exist (e.g. have no row in the database)
• ACLs with a script that contains "answer=true" or "true"