WFS-T error "<layer> is read-only"

[jirik]

Layman version: 1.23.0, 1.23.1

Steps to reproduce:

• Publish layer, set write right to specific user (or role):

  {
  "read": [
      "filip",
      "EVERYONE"
  ],
  "write": [
      "filip"
  ]
  }

• Send WFS-T request auhenticated as the user:

  <Transaction xmlns="http://www.opengis.net/wfs" service="WFS" version="1.1.0"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.opengis.net/wfs http://schemas.opengis.net/wfs/1.1.0/wfs.xsd">
  <Insert>
      <draw_layer xmlns="http://filip/">
          <wkb_geometry>
              <Point xmlns="http://www.opengis.net/gml" srsName="EPSG:3857">
                  <pos srsDimension="2">1833791.5141005216 6302414.620768601</pos>
              </Point>
          </wkb_geometry>
          <name>Draw layer</name>
      </draw_layer>
  </Insert>
  </Transaction>

Expected behaviour:

• WFS-T request is processed

Current behaviour:

• Error is returned:

  <?xml version="1.0" encoding="UTF-8"?><ows:ExceptionReport xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:ows="http://www.opengis.net/ows" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="1.0.0" xsi:schemaLocation="http://www.opengis.net/ows https://watlas.lesprojekt.cz/geoserver/schemas/ows/1.0.0/owsExceptionReport.xsd">
  <ows:Exception exceptionCode="NoApplicableCode">
  <ows:ExceptionText>{http://filip/}draw_layer is read-only</ows:ExceptionText>
  </ows:Exception>
  </ows:ExceptionReport>

[jirik]

It affects only older instances than 1.23.0 that were migrated to 1.23.0 or 1.23.1.

Steps to fix:

• Log in to GeoServer admin
• Go to Security > Authentication, in part "Authentication Filters" click on "laymanHttpHeader"
• In part "Role source" choose "Role service" in left dropdown and "layman_role_service" in right dropdown.
• Click on "Save" button