[jira] [Updated] (MESOS-7014) Add implicit executor authorization to local authorizer

["Greg Mann (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/MESOS-7014?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Greg Mann updated MESOS-7014:
-----------------------------
    Description: The local authorizer should be updated to perform implicit authorization of executor actions. When executors authenticate using a default executor secret, the authorizer will receive an authorization {{Subject}} which contains claims, but no principal. In this case, implicit authorization should be performed. Implicit authorization rules should enforce that an executor can perform actions on itself; i.e., subscribe as itself, send messages as itself, launch nested containers within itself.  (was: The local authorizer should be updated to perform implicit authorization of executor actions. When executors authenticate using a default executor secret, the authorizer will receive an authorization {{Subject}} which contains claims, but no principal. In this case, implicit authorization should be performed.)

> Add implicit executor authorization to local authorizer
> -------------------------------------------------------
>
>                 Key: MESOS-7014
>                 URL: https://issues.apache.org/jira/browse/MESOS-7014
>             Project: Mesos
>          Issue Type: Task
>          Components: security
>            Reporter: Greg Mann
>              Labels: authorization, executor, mesosphere, security
>
> The local authorizer should be updated to perform implicit authorization of executor actions. When executors authenticate using a default executor secret, the authorizer will receive an authorization {{Subject}} which contains claims, but no principal. In this case, implicit authorization should be performed. Implicit authorization rules should enforce that an executor can perform actions on itself; i.e., subscribe as itself, send messages as itself, launch nested containers within itself.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)