[MESOS-7097] Framework credentials can be used to register as an agent.

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.3.0
• Assignee: Yan Xu
• Reporter: Yan Xu
• Created: 09/Feb/17 19:30
• Updated: 12/Jun/18 22:48
• Resolved: 28/Apr/17 22:12

Description

Mesos uses the same credentials for all default http authenticators and the crammd5 authenticator, across clients that include frameworks, agents and operators. All authenticated clients are treated the same until the authorizer kicks in when handling specific actions.

There's currently not an ACL that limits who can/cannot register as agents so whoever obtains the framework credentials can freely do so. The ability to register as agents should be limited to the entities with the agent credentials/principles.

Issue Links

• relates to: MESOS-8987 Master asks agent to shutdown upon auth errors.