Always set the keystore shard in maybeUnlockKeystore()

server/http.go

@@ -193,7 +193,6 @@ func (h *Server) maybeUnlockKeystore(ctx context.Context, username, password str
 		return false, nil
 	}
 
-	var shard string
 	if len(h.keystoreGroups) > 0 {
 		if userinfo == nil {
 			return false, nil
@@ -201,8 +200,13 @@ func (h *Server) maybeUnlockKeystore(ctx context.Context, username, password str
 		if !inAnyGroups(userinfo.Groups, h.keystoreGroups) {
 			return false, nil
 		}
+	}
+
+	var shard string
+	if userinfo != nil {
 		shard = userinfo.Shard
 	}
+
 	// Add a 'grace time' of 30 minutes to the key ttl.
 	ttl := h.authSessionLifetime + 1800
 	return true, h.keystore.Open(ctx, shard, username, password, ttl)