[MESOS-2001] Authenticatee modules similar to Authenticator modules

• Type: Epic
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Component/s: modules
• Labels: authentication module
• Epic Name: Authenticatee Module
• Target Version/s: 0.22.0
• Sprint: Mesosphere Q4 Sprint 1 10/31, Mesosphere Q4 Sprint 2 - 11/14, Mesosphere Q4 Sprint 3 - 12/7
• Assignee: Till Toenshoff
• Reporter: Till Toenshoff
• Shepherd: Adam B
• Created: 28/Oct/14 14:13
• Updated: 29/Apr/19 09:27
• Resolved: 17/Nov/14 23:05

Description

For covering a complete modules based authentication, we will need to allow for authenticatee modules just like we are with authenticator modules.

Motivation

Allow for third parties to quickly develop and plug-in new authentication methods. The modularized Authenticatee API will lower the barrier for the community to provide new methods to Mesos. An example for such additional, next step module could be PAM (LDAP, MySQL, NIS, UNIX) backed authentication. cyrus-sasl2 itself already offers more than a half a dozen mechanisms via its standard plugins and these could be triggered by additional Authenticator / Authenticatee modules. cyrus-sasl2 does support even more mechanisms when being custom built (about a full dozen) but we do not want to bundle cyrus-sasl2 to enforce custom builds. Alternative authentication (especially non-SASL based) methods may bring in new dependencies that we don't want to enforce on all of our users. Mesos users may be required to use custom authentication techniques due to strict security policies.