fix(s3): allow deleting the anonymous user from admin webui (#8706)

Remove the block that prevented deleting the "anonymous" identity
and stop auto-creating it when absent.  If no anonymous identity
exists (or it is disabled), LookupAnonymous returns not-found and
both auth paths return ErrAccessDenied for anonymous requests.

To enable anonymous access, explicitly create the "anonymous" user.
To revoke it, delete the user like any other identity.

Closes #8694
This commit is contained in:
Chris Lu
2026-03-19 18:10:20 -07:00
committed by GitHub
parent 08b79a30f6
commit 6ccda3e809
3 changed files with 47 additions and 70 deletions

View File

@@ -153,13 +153,6 @@ func (s *AdminServer) DeleteObjectStoreUser(username string) error {
return fmt.Errorf("credential manager not available")
}
// Prevent deletion of the anonymous identity — it is a system identity
// used for unauthenticated S3 access. Removing it would break anonymous
// request handling in the IAM layer.
if username == "anonymous" {
return fmt.Errorf("cannot delete the system identity 'anonymous'")
}
ctx := context.Background()
// Delete user using credential manager