Marathon: ACL / Role Based Access Control support?

[SEJeff]

I know marathon supports HTTP Basic auth support, but it would be nice if there was a flexible RBAC / ACL system.

I'd like to use Marathon in a multi-tenant environment where each "tenant" (team at our company) is capable of managing jobs specific to their team. There are a few superuser groups who can see/manage everything, and a few "sub-admin" teams that can manage all jobs for a certain other group type, but in general, each team owns their own jobs.

Currently the group mapping is all stored in LDAP and cleanly maps from user --> group. This would be a fantastic addition to an already quite fantastic tool.

[guenter]

@SEJeff thanks for the praise :) LDAP is on the roadmap, but no date yet.

[j1n6]

1+ This is awesome feature to have!
Since this is related to security concern, I wonder if there are any suggested methods (or future roadmap) to distribute application secrets. In real scenario, it's not ideal to distribute all application/process specific secrets in slaves partition (because Mesos might allocate process in any partitioned slave).

[3rdman]

+1 as well, having this would be fantastic.

[StephanErb]

Have you considered running a nginx before marathon which performs the ldap authentication for you? That won't help with the webui, but you can at least manage the access to REST api.

[SEJeff]

@StephanErb That is the obvious thing to do, but that is not what I'm asking for. I'm asking for proper fine-grained role based access control, not course based acls via a front-end such as nginx.

[benmccann]

@SEJeff I agree 100%. Sent a pull request to begin adding support for this in the REST framework. As mentioned in that pull request it turns out that Apache Aurora is working on taking a very similar approach to the one I suggested.

Also, somewhat related is that fact that right now in Mesos a framework can register with a single role, so to allow users of Marathon to select a per-app role, we would need to be able to register with multiple roles. You may want to follow and vote for the open JIRA issue to support this.

[SEJeff]

@benmccann Thanks! I also quite like the way consul does it in that it is super similar to the way Amazon does it, which is quite familar to various cloud-ish tools and people :)

See this document for their inspiration.

[bsideup]

:+1:

[h0tbird]

+1

[cfz]

+1

[jlrigau]

:+1:

[ankurpshah]

:+1:

[mlowicki]

Seems that discussion died at some point. Very long time ago it was mentioned that LDAP is on the roadmap but no official movements since then.

@guenter @gkleiman any news? I guess many people (including me) would be willing to help but would be good how the situation looks now.

[markrey]

+1

[gkleiman]

@mlowicki Marathon now supports plugins for authorization and authentication. You can write one that provdes LDAP integration.

Enterprise DC/OS comes with LDAP integration out of the box.

[SEJeff]

@gkleiman Thanks! Is that LDAP plugin on the roadmap to ever make it into the OSS DC/OS?

[janisz]

@mlowicki @SEJeff when plugin interface comes out I wrote simple plugin using shiro https://github.com/janisz/marathon-shiro-authentication-plugin It authenticate users and authorize if their groups matches the application path.

Shiro provides out-of-the-box realms for popular data sources like LDAP, Active Directory, Kerboros, and JDBC. If needed, you can also create your own realms to support specific functionality not included in the basic realms.

It's probably easiest way to set up LDAP with Marathon. Code is stale and needs update but core concept is pretty simple.

[jasongilanfarr]

As there are plugins available to do this, closing out.