[MESOS-5369] Coarse-grained authorization of endpoints is supported only for short url paths.

• Type: Bug
• Status: Accepted
• Priority: Minor
• Resolution: Unresolved
• Affects Version/s: 1.0.0
• Labels: authorization integration mesosphere security
• Epic Link: Authorization Improvements
• Assignee: Unassigned
• Reporter: Alex R
• Shepherd: Alex R
• Created: 12/May/16 13:33
• Updated: 29/Apr/19 09:27

Description

For coarse-grained authorization actions, e.g., GET_ENDPOINT_WITH_PATH, we currently pass the short version of the url path, i.e., /state instead of /master/state, to the authorizer in some cases. This means that ACLs for local authorizer will not work as expected if absolute paths are used. Moreover, both local and modularized authorizers should be able to understand both short url paths for endpoints that belong to the "major" actor process (e.g., master, agent) and absolute url paths for all other actors (e.g., /files/browse, /metrics/snapshot.

One possible solution is to pass absolute paths to authorizers and let them do the necessary processing, e.g., removing agent id from /slave(id)/state. This will also require normalizing endpoints from ACLs to absolute path form, similarly as we have done in MESOS-3143. Additionally this solution removes ambiguity which may arise for same endpoints belonging to different actors, e.g., /master/flags vs. /slave/flags.

Here are some code snippets to illustrate the problem and the reasons:

• https://github.com/apache/mesos/blob/eaf0d3461b3f17c9037490e873f114c2ee1c14d9/src/slave/http.cpp#L824-L833
• https://github.com/apache/mesos/blob/0104e7349a0539f38d02a0e7e23b7712ebefc201/3rdparty/libprocess/src/process.cpp#L2398
• https://github.com/apache/mesos/blob/0104e7349a0539f38d02a0e7e23b7712ebefc201/src/master/main.cpp#L247
• https://github.com/apache/mesos/blob/0104e7349a0539f38d02a0e7e23b7712ebefc201/3rdparty/libprocess/src/process.cpp#L2875

Issue Links

• relates to: MESOS-5357 Add a function to extract HTTP endpoints from an URL.
• relates to: MESOS-5299 Support hierarchy based matching of HTTP endpoint authorization requests.