[MESOS-7222] Load authenticator modules as singletons

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Component/s: security
• Labels: authentication libprocess mesosphere tech-debt
• Epic Link: Authorization Improvements
• Assignee: Unassigned
• Reporter: Greg Mann
• Created: 08/Mar/17 21:01
• Updated: 29/Apr/19 09:26

Description

The Mesos master/agent code currently loads separate instances of an authenticator module for each realm that the module is installed into. initializeHttpAuthenticators() is called multiple times, and each invocation creates an instance of the module.

It would be better to create a singleton of each authenticator module. These could be stored in a map, indexed by the module name. Note that libprocess's setAuthenticator() helper currently accepts an Owned<Authenticator> and takes ownership of each module instance. In order to pass ownership of authenticator singletons to libprocess, setAuthenticator() could be changed to something like the following:

Future<Nothing> setAuthenticator(
    const map<string, Owned<Authenticator>> authenticators,
    const map<string, string> authenticatorRealms);

Note that the current situation would cause a legitimate bug in the case of a stateful authenticator module which is dynamically updated at runtime. This could lead to inconsistent state across the module instances, when the author intended for them to share a single global state.

Issue Links

• relates to: MESOS-7004 Enable multiple HTTP authenticator modules