Access Control Enforcement

Release date 2025/12/18

Feature

• Enabled at-rest keyring encryption for sensitive fields in ACE plugin.

• Added operation_id in analytics and set it to the header X-ACE-Operation-ID.

• ace_credentials can now be linked to Consumers or Consumer Groups

Bugfix

• Fixed an issue where the anonymous consumer was not being set properly when authentication failed.

• Fixed an issue where users could set the anonymous field in the OpenID Connect configuration of ACE auth strategies, which is not supported and could lead to unexpected authentication behavior.

• Fixed an issue where multiple key-auth strategies could not use the same apikey.

• Fixed an issue where observability headers could not be set correctly in some unhappy paths.