Mailing-List: contact dev-help@mesos.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@mesos.apache.org
Subject: Re: WebUI authentication in 1.0.0-rc1
To: dev@mesos.apache.org
References: <5751CE26.3020500@yandex-team.ru>
 <CAL3vCQo+ni74uvQFH2NPLs4dZLh4kKHQkkW8tgthEBP54t=Y+w@mail.gmail.com>
 <5755423D.9090408@yandex-team.ru>
 <CAMvp0pTiOGkA-o4rC5MWA4O2SD=Ua1hwOKvoPYajHip=+hA1EA@mail.gmail.com>
 <CAL2dqyODCrgDPT8Ge-ALSVt2xx4ub=-ATn3nJT=hU3eeadGq-w@mail.gmail.com>
 <CAOW5sYbQMbSFL1b-Vdvtq3=q37h6nE88=D4Q1nig+B2=V5yC9A@mail.gmail.com>
 <CAMvp0pRXXa0K1sjw=cr_RTUjmbS+yGhDvezecOz5RnPm07MNyg@mail.gmail.com>
From: Evers Benno <bennoe@yandex-team.ru>
Message-ID: <575AEECF.5020108@yandex-team.ru>
Date: Fri, 10 Jun 2016 18:46:07 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101
 Thunderbird/38.8.0
MIME-Version: 1.0
In-Reply-To: <CAMvp0pRXXa0K1sjw=cr_RTUjmbS+yGhDvezecOz5RnPm07MNyg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Fri, 10 Jun 2016 16:46:22 -0000

Sure,

it looks like this, not very imaginative. There is currently no
authorization on the agents.

    {
        "permissive": false,

        [...] // Here is the previous ACL with actions "run_tasks" and
"register_frameworks"

        "get_endpoints": [
            {
                "principals": {"type": "ANY"},
                "paths": {"type": "ANY"}
            }
        ],

        "view_frameworks": [
             {
                 "principals": {"type": "ANY"},
                 "users": {"type": "ANY"}
             }
        ],

        "view_tasks": [
             {
                 "principals": {"type": "ANY"},
                 "users": {"type": "ANY"}
             }
        ],

        "view_executors": [
             {
                 "principals": {"type": "ANY"},
                 "users": {"type": "ANY"}
             }
        ],

        "access_sandboxes": [
             {
                 "principals": {"type": "ANY"},
                 "users": {"type": "ANY"}
             }
        ],

        "access_mesos_logs": [
             {
                 "principals": {"type": "ANY"},
                 "logs": {"type": "ANY"}
             }
        ]
    }


On 10.06.2016 00:17, Greg Mann wrote:
> Benno,
> Would you mind providing more information on the ACL definitions that you
> used to gain full access to the web UI? I'm working on some more
> documentation for this. Also, did you have authorization enabled on the
> agents as well?
> 
> Cheers,
> Greg
> 
> On Wed, Jun 8, 2016 at 7:43 AM, Neil Conway <neil.conway@gmail.com> wrote:
> 
>> On Wed, Jun 8, 2016 at 4:27 PM, Alexander Rojas <alexander@mesosphere.io>
>> wrote:
>>> I think we should also think more thoroughly about the expected behaviour
>>> when we introduce new authorizable actions (and we most certainly will).
>>> Since things may break particularly if users set the `permissive` ACL
>> field
>>> to false.
>>>
>>> Perhaps initially, if no ACL is given for the new action we print a
>> warning
>>> message and behave as if the field had an ACL such as
>>>
>>> ```
>>> {
>>>   "principals": {"type": "ANY"}
>>>   "action":{"type": "ANY"}
>>> }
>>> ```
>>
>> An ACL configuration that omits any rules for a particular action is
>> not an invalid way to configure the system. e.g., suppose we added the
>> "/teardown" endpoint in Mesos 1.1, along with the
>> "teardown_frameworks" ACL. A perfectly reasonable way to configure the
>> behavior "no one should be allowed to use the /teardown endpoint" is
>> an ACL configuration that has "permissive: false" and doesn't
>> otherwise mention "teardown_frameworks".
>>
>> The situation here is a little unusual, because we're introducing ACLs
>> for behavior that was previously not covered by the authorization
>> system, rather than new functionality. But overall, I think the
>> situation can be addressed by documenting the new behavior
>> *prominently* in the release notes / upgrade docs -- anyone upgrading
>> to a non-patch release should be reading that document anyway, and the
>> required changes will usually be straightforward.
>>
>> Neil
>>
>