The default auth_backend of "noauth" means that if there happens to be a failure reading the config file, you end up with a system that doesn't do authentication.
Please require the installation to be explicitly set to "noauth" for that backend to be used. Also, please print a warning to the log file.
Metadata Update from @jkaluza: - Issue status updated to: Closed (was: Open)
https://pagure.io/odcs/pull-request/68
See also #63.
This issue has been migrated to Fedora Forge: https://forge.fedoraproject.org/pungi/odcs/issues/59
Please continue any further discussion there.