fix(admin): show anonymous user in Object Store Users UI (#8671)

The anonymous identity was explicitly filtered out of the user listing,
making it invisible in the admin console. Users could not view or edit
its permissions. Attempting to recreate it failed with "already exists".

Remove the anonymous skip in GetObjectStoreUsers so it appears like any
other identity. Add a guard in DeleteObjectStoreUser to prevent deletion
of the anonymous system identity, which would break unauthenticated S3
access.

Fixes #8466

Co-authored-by: Copilot <copilot@github.com>
This commit is contained in:
Chris Lu
2026-03-16 19:54:57 -07:00
committed by GitHub
parent 6e45fc0055
commit a3717cd4b5
2 changed files with 7 additions and 5 deletions

View File

@@ -153,6 +153,13 @@ func (s *AdminServer) DeleteObjectStoreUser(username string) error {
return fmt.Errorf("credential manager not available")
}
// Prevent deletion of the anonymous identity — it is a system identity
// used for unauthenticated S3 access. Removing it would break anonymous
// request handling in the IAM layer.
if username == "anonymous" {
return fmt.Errorf("cannot delete the system identity 'anonymous'")
}
ctx := context.Background()
// Delete user using credential manager