Sry, my original assumption was that :authenticate filter denies access, when the user is not set, so the original code should work, in that case, https://github.com/ehelms/katello/blob/refs-5217/app/services/katello/authentication/client_authentication.rb#L21 should also be changed to not deny the access directly, just return true or false