Can you help us understand more about the error message you're seeing, or steps to reproduce?

The hub permits anonymous clients to call the getUser RPC without authenticating. I'm thinking we should keep the code as-is so we don't have to touch the sessions table any more than necessary.

It looks to me, that it could be some environment which doesn't have anonymous calls enabled? (httpd conf requireing auth everywhere not only for login endpoint) If it is a case then there would be failing all anonymous calls.

Yes, @tkopecek is right, thanks. Our environment doesn't have anonymous calls enabled, httpd conf requires ssl client cert auth everywhere, so you can't read/download anything - this is an infosec requirement we have. And yes, there would be failing all anonymous calls. My bad, fix in this PR only applies to Koji 1.21.1 and lower, where we used --force-auth argument for all commands, so "anonymous" commands (anon_*) worked well in this environment.

As I see, Koji 1.22 replaced activate_session() with ensure_connection() for anonymous commands. So the --force-auth argument doesn't work as intended. Should I open separate issue for this? Also it would be nice to have some koji.conf parameter for force-auth, so it wouldn't be needed every time in such an environment.

I've opened #2657. Can we close this one?

Thank you. Closing this one.