Treat key-auth's config.anonymous "" as null

[mtmail]

Summary

In the past key-auth's config.anonymous was set to "" (empty string) in the database. Starting Kong 2.0 that causes failed to load anonymous consumer error.

Steps To Reproduce

We upgraded from Kong 1.4 to 2.0.2. (And previously 0.9 to 1.1, then 1.1 to 1.4). Very early we added key-auth plugin like this

curl -s -X POST \
  --url http://localhost:8001/services/ourservice/plugins/ \
  --data 'name=key-auth'

without any other config values set.

In Kong 1.4 and 2.0 in the database that get stored as

select * from plugins where name='key-auth' and consumer_id is null;

id          | edca177b-77b6-457c-9019-9105badbeea1
name        | key-auth
api_id      |
consumer_id |
config      | {"anonymous": "", "key_names": ["apikey"],
"hide_credentials": false, "run_on_preflight": true}

Based on the documentation https://docs.konghq.com/hub/kong-inc/key-auth/ I wouldn've expected the database to show "anonymous: null" or the key not existent. 91a5738dcf5 looks like the change from boolean to string type.

No problem in Kong 1.4. A URL request without any authentication key (key name apikey by default) set, e.g. curl http://localhost:8000/ourservice/ returns HTTP/1.1 401 Unauthorized and body {"message":"No API key found in request"}.

Starting Kong 2.0 the same request returns HTTP/1.1 500 Internal Server Error with body {"message":"An unexpected error occurred"}. The kong logfile contains *2400 [kong] handler.lua:193 [key-auth] failed to load anonymous consumer:failed to get from node cache: [postgres] length must be at least 1, client: 127.0.0.1, server: kong, request: "GET /ourservice HTTP/1.1", host: "localhost:8000"

It is no longer clear what set anonymous": "" in the database in the past, but it seems it was the default setting. Upgrading to Kong 2.0 broke the default behaviour.

Comment #3222 (comment) from Kong 0.12.1 shows an example how the value was set to empty string in the past.

#2539 shows how Kong 0.10. set the default to empty string and how previous logic looked at both empty string and null/nil.

.//kong/plugins/key-auth/handler.lua:    if conf.anonymous ~= "" and conf.anonymous ~= nil then

Expected behaviour

Either

• Add a note about a breaking change to the https://github.com/Kong/kong/blob/master/UPGRADE.md documentation
• Have a migration convert the value during an upgrade ("" to null)
• Treat empty string the same as null

I'd prefer the latter, but the Kong maintaners are more expert at backward compatibility, the DAO (which keeps changing) and side-effects with other auth plugins. I argue a Kong administrator setting the value to empty string made clear it's neither meant to be a UUID or username.

Workaround

We changed the value in the database with a SQL statement. It was unclear how to unset a value. Setting it to null via the Admin API returned {"message":"invalid primary key: '{id=\"expected a valid UUID\"}'","name":"invalid primary key","fields":{"id":"expected a valid UUID"},"code":1

Additional Details & Logs

• Kong version (2.0.2)
• Ubuntu 16

[dsteinkopf]

I am having the same problem with key-auth after upgrading from 1.4 to 2.0 And it seems we have a very similar problem with the plugin basic-auth: Here the old value of config.anonymous isn't "" (empty string) but it is missing instead. But the resulting error is the same. May this problem could be fixed at the same time. Thank you!

In the meantime as a workaround setting config.anonymous to null works for me:

curl -i -X PATCH --url http://mykong/plugins/<plugin_is> --data "config.anonymous="