You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@mesos.apache.org by "Adam B (JIRA)" <ji...@apache.org> on 2016/05/06 09:53:12 UTC

[jira] [Created] (MESOS-5335) Add authorization to GET /weights

Adam B created MESOS-5335:
-----------------------------

             Summary: Add authorization to GET /weights
                 Key: MESOS-5335
                 URL: https://issues.apache.org/jira/browse/MESOS-5335
             Project: Mesos
          Issue Type: Improvement
          Components: master, security
            Reporter: Adam B
             Fix For: 0.29.0


We already authorize which http users can update weights for particular roles, but even knowing of the existence of these roles (let alone their weights) may be sensitive information. We should add authz around GET operations on /weights.
Easy option: GET_ENDPOINT_WITH_PATH /weights
+ No new verb
- All or nothing
Complex option: GET_WEIGHTS_WITH_ROLE
+ Filters contents based on roles the user is authorized to see
- More authorize calls (one per role in each /weights request)



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)