[MESOS-7014] Add implicit executor authorization to local authorizer

• Type: Task
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0
• Component/s: security
• Labels: authorization executor mesosphere security
• Epic Link: Executor Authentication
• Sprint: Mesosphere Sprint 54, Mesosphere Sprint 55
• Story Points: 3
• Assignee: Greg Mann
• Reporter: Greg Mann
• Shepherd: Vinod Kone
• Created: 26/Jan/17 17:48
• Updated: 29/Apr/19 09:26
• Resolved: 21/Apr/17 19:12

Description

The local authorizer should be updated to perform implicit authorization of executor actions. When executors authenticate using a default executor secret, the authorizer will receive an authorization Subject which contains claims, but no principal. In this case, implicit authorization should be performed. Implicit authorization rules should enforce that an executor can perform actions on itself; i.e., subscribe as itself, send messages as itself, launch nested containers within itself.

Issue Links

• blocks: MESOS-7339 Add authorization to agent executor API