[MESOS-5709] Authorization for /roles

• Type: Task
• Status: Resolved
• Priority: Blocker
• Resolution: Fixed
• Fix Version/s: 1.0.0
• Component/s: security
• Labels: mesosphere security
• Epic Link: Authorize operator endpoints
• Sprint: Mesosphere Sprint 38
• Story Points: 3
• Assignee: Jörg Schad
• Reporter: Adam B
• Shepherd: Vinod Kone
• Created: 24/Jun/16 12:18
• Updated: 29/Apr/19 09:27
• Resolved: 05/Jul/16 05:29

Description

The /roles endpoint exposes the list of all roles and their weights, as well as the list of all frameworkIds registered with each role. This is a superset of the information exposed on GET /weights, which we already protect. We should protect the data in /roles the same way.

• Should we reuse VIEW_FRAMEWORK with role (from /state)?
• Should we add a new VIEW_ROLE and adapt GET_WEIGHTS to use it?