TODO(greggomann): Remove this function when implicit executor authorization is moved into the authorizer. See MESOS-7399.
| 696 | // TODO(greggomann): Remove this function when implicit executor authorization |
| 697 | // is moved into the authorizer. See MESOS-7399. |
| 698 | Option<Error> verifyExecutorClaims( |
| 699 | const Principal& principal, |
| 700 | const FrameworkID& frameworkId, |
| 701 | const ExecutorID& executorId, |
| 702 | const ContainerID& containerId) { |
| 703 | if (!(principal.claims.contains("fid") && |
| 704 | principal.claims.at("fid") == frameworkId.value())) { |
| 705 | return Error( |
| 706 | "Authenticated principal '" + stringify(principal) + "' does not " |
| 707 | "contain an 'fid' claim with the framework ID " + |
| 708 | stringify(frameworkId) + ", which is set in the call"); |
| 709 | } |
| 710 | |
| 711 | if (!(principal.claims.contains("eid") && |
| 712 | principal.claims.at("eid") == executorId.value())) { |
| 713 | return Error( |
| 714 | "Authenticated principal '" + stringify(principal) + "' does not " |
| 715 | "contain an 'eid' claim with the executor ID " + |
| 716 | stringify(executorId) + ", which is set in the call"); |
| 717 | } |
| 718 | |
| 719 | if (!(principal.claims.contains("cid") && |
| 720 | principal.claims.at("cid") == containerId.value())) { |
| 721 | return Error( |
| 722 | "Authenticated principal '" + stringify(principal) + "' does not " |
| 723 | "contain a 'cid' claim with the correct active ContainerID"); |
| 724 | } |
| 725 | |
| 726 | return None(); |
| 727 | } |
| 728 | |
| 729 | |
| 730 | Future<Response> Http::executor( |