Features in controller authentication are not loaded correctly if you modify them from plugins
add_smart_proxy_filters helper to configure authentication for requests coming from proxy (usually facts/reports). We pass features of proxies that should be considered as authenticated but since it's on class definition level, it evaluates during load time. If we register new importers that adds new potential feature, they are not re-evaluated. We should use pass Procs and evaluate them during runtime if we need dynamic list.
Updated by Marek Hulán about 8 years ago
For reproducers: it happens in development env if something loads v2 hosts controller (e.g. foreman-tasks) because it includes some concern. Then when another plugin registers new fact importer (foreman_chef, or I suppose foreman_salt as well) you won't see it in #require_smart_proxy_or_login among features hence authentication fails.