Authentication Support

Status:

The project, although is still ongoing, could not be finalized until September 23, the date that marks the end of the coding period of Google Summer of Code. Caused mainly by the problems encountered during utilization of Cyrus SASL library (e.g. Cyrus SASL mailing list not being responsive at the time) the authenticator classes produced until the end of GSoC coding period could not be integrated into Mesos source code, yet. Still, the project is to continue, under the supervision of Vinod Kone, the GSoC mentor of this project, and Mesos community in general, according to the roadmap below.

Goal:

The goal of this project is to make the communication between the components that form Mesos more secure by solving the authentication part of the JIRA issue MESOS-418. The project is also a Google Summer of Code project.

Scope:

The project involves adding an authentication stage before letting frameworks and slaves talk to the master(s) thereby making the communication between the modules forming Mesos (masters, slaves and frameworks) secure.

Technical Details:

For authentication support, the initial idea was making use of Kerberos as a mechanism for authentication, just as Hadoop offers. But, providing alternative authentication mechanisms to Kerberos would make Mesos available to systems that are not able to support Kerberos. To be able to flexibly deal with multiple different authentication mechanisms, it was better to create an abstraction between Mesos and the relevant authentication mechanisms. This way, community of Mesos developers could more freely choose and more easily implement and update the authentication mechanisms they use. As a result, Cyrus SASL library is chosen to be used by the authentication abstraction as it supports multiple authentication mechanisms and has a generic authentication negotiation process for all the mechanisms it supports.

The details will be clarified further as the project progresses, and they will be reflected to this wiki page.