Mailing-List: contact issues-help@mesos.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@mesos.apache.org
Date: Wed, 20 Jul 2016 03:12:21 +0000 (UTC)
From: "Zhitao Li (JIRA)" <jira@apache.org>
To: issues@mesos.apache.org
Message-ID: <JIRA.12989875.1468605639000.79637.1468984341211@Atlassian.JIRA>
In-Reply-To: <JIRA.12989875.1468605639000@Atlassian.JIRA>
References: <JIRA.12989875.1468605639000@Atlassian.JIRA> <JIRA.12989875.1468605639915@arcas>
Subject: [jira] [Commented] (MESOS-5851) Create mechanism to control
 authentication between different HTTP endpoints
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Wed, 20 Jul 2016 03:12:23 -0000


    [ https://issues.apache.org/jira/browse/MESOS-5851?page=3Dcom.atlassian=
.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D1538=
5244#comment-15385244 ]=20

Zhitao Li commented on MESOS-5851:
----------------------------------

[~greggomann] and [~vinodkone], I'd like to design the new flags from the p=
erspective of easy and consistent upgrade.

I believe all endpoints in READ_ONLY realm was not authenticated in 0.28.x,=
 then the existing {{--authenticate_http}} flag only maps to endpoints in R=
EAD_WRITE realm. We can introduce another flag {{--authenticate_http_read_o=
nly}}, which defaults to {{false}}. This allows operator to upgrade to 1.0 =
with the same behavior.

For the sake of consistent, I think we should also create an alias flag {{-=
-authenticate_http_read_write}} in favor of {{--authenticate_http}}, and ex=
plicitly call the latter deprecated from this cycle.

Given that making new flag required is very unfriendly during upgrade, I ca=
n't really think of a good way to introduce new flag and making upgrade eas=
y. Please advise if you have better idea.

> Create mechanism to control authentication between different HTTP endpoin=
ts
> -------------------------------------------------------------------------=
--
>
>                 Key: MESOS-5851
>                 URL: https://issues.apache.org/jira/browse/MESOS-5851
>             Project: Mesos
>          Issue Type: Bug
>          Components: libprocess
>    Affects Versions: 1.0.0
>            Reporter: Zhitao Li
>              Labels: mesosphere, security
>             Fix For: 1.0.0
>
>
> All endpoints authentication is controlled by one single flag. We need th=
is flag to be on so that `/reserve` `/unreserve` can get a principal.
> However, after 1.0, we cannot access important readonly endpoints `/maste=
r/state/` and `/metric/snapshot/` anymore w/o a password. The latter is det=
rimental on usability because many users don't have the supporting infra to=
 distribute such metrics into every metrics collecting process yet.
> I'm looking towards a mechanism to at least allow unauthenticated access =
to selective whitelisted endpoints while keep endpoints requiring AuthN/Aut=
hZ still protected.
> quoting Joseph Wu, "we want a `--authenticate_http=3Dtrue, but don't chec=
k` option"
> Proposed endpoint to realm grouping by [~zhitao]
> {quote}
> /////////////
> // Common realms shared by both master and agent
> =E2=80=8B////////////
> FLAGS
> - /flags
> =E2=80=8B
> FILES
> - /files/browse
> - /files/browse.json
> - /files/debug
> - /files/debug.json
> - /files/download
> - /files/download.json
> - /files/read
> - /files/read.json
> =E2=80=8B
> LOGGING
> - /logging/toggle
> =E2=80=8B
> METRICS
> - /metrics/snapshot
> =E2=80=8B
> PROFILER
> - /profiler/start
> - /profiler/stop
> =E2=80=8B
> SYSTEMS
> - /system/stats.json
> =E2=80=8B
> VERSIONS
> - /version
> =E2=80=8B
> /////////////////
> // Additional master only realms
> =E2=80=8B////////////////
> MAINTENANCE
> - /machine/down
> - /machine/up
> - /maintenance/schedule
> - /maintenance/status
> =E2=80=8B
> OPERATORS
> - /api/v1
> =E2=80=8B
> SCHEDULERS
> - /api/v1/scheduler
> =E2=80=8B
> REGISTRARS
> - /registrar(id)/registry
> =E2=80=8B
> RESERVATIONS
> - /reserve
> - /unreserve
> - /quota
> - /weights
> =E2=80=8B
> TEARDOWN
> - /teardown
> =E2=80=8B
> VIEWS
> - /frameworks
> - /roles
> - /roles.json
> - /slaves
> - /state
> - /state-summary
> - /state.json
> - /tasks
> - /tasks.json
> =E2=80=8B
> VOLUMES
> - /create-volumes
> - /destroy-volumes
> =E2=80=8B
> UNAUTHENTICATED
> - /health
> - /redirect
> =E2=80=8B
> ////////////////
> // Additional agent realms
> ////////////////
> =E2=80=8B
> OPERATORS
> - /api/v1
> =E2=80=8B
> VIEWS
> - /containers
> - /monitor/statistics
> - /monitor/statistics.json
> - /state
> - /state.json
> =E2=80=8B
> UNAUTHENTICATED
> - /api/v1/executor
> - /health
> {quote}


--
This message was sent by Atlassian JIRA
(v6.3.4#6332)