[
https://issues.apache.org/jira/browse/MESOS-5343?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15279217#comment-15279217
]
Vinod Kone commented on MESOS-5343:
-----------------------------------
Why do we want to load an authenticator if we have not enabled authN? i would
like the master to match the agent's behavior here after a deprecation cycle.
IIUC `--http_authenticators` flag on master followed the footsteps of
`--authenticator` flag, without realizing that the latter one needed a default
flag value for backwards compatibility.
> Behavior of custom HTTP authenticators with disabled HTTP authentication is
> inconsistent between master and agent
> -----------------------------------------------------------------------------------------------------------------
>
> Key: MESOS-5343
> URL: https://issues.apache.org/jira/browse/MESOS-5343
> Project: Mesos
> Issue Type: Bug
> Affects Versions: 0.29.0
> Reporter: Benjamin Bannier
> Priority: Minor
> Labels: mesosphere, security
> Fix For: 0.29.0
>
>
> When setting a custom authenticator with {{http_authenticators}} and also
> specifying {{authenticate_http=false}} currently agents refuse to start with
> {code}
> A custom HTTP authenticator was specified with the '--http_authenticators'
> flag, but HTTP authentication was not enabled via '--authenticate_http'
> {code}
> Masters on the other hand accept this setting.
> Having differing behavior between master and agents is confusing, and we
> should decide on whether we want to accept these settings or not, and make
> the implementations consistent.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
