Hi All, I've had a few conversations offline with mesos contributors regarding authorization and authentication. I'd like to solicit the larger community for comments.
I want to create groups of people and allow those groups to only launch tasks as certain unix users. Commonly, this unix user is a service user which has a 1:1 relationship to a group. Mesos "users" are frameworks. Using the framework authorization features that were introduced in 0.20.0 frameworks can be authorized to run tasks as certain unix users. Mesos delegates the question of what people can launch a task as what service users to the framework. I don't want to have to trust that two frameworks will enforce a consistent view of authorization. From a security standpoint this transitive trust significantly raises the auditing burden. What happens when one framework thinks jaybuff is in the ads group, but the other framework says he is not? Jay
