Mesosphere Marathon has adapted their plugin interface, offering two extension points. This includes the ability to have custom plugins handling UI/Rest based authentication as well as securing operations.
I looked around to see what has been released in the open source community and didn’t see much. I wanted to be able to lock down Marathon based on the following requirements:
- UI/REST based authentication against LDAP / Active Directory
- Ability to offer flexible configuration based on LDAP Groups, for example:
- Everyone who is authenticated should be able to see running containers
- Admins have unlimited control
- Developers can do full CRUD operations against an ID namespace of /dev
As a result of these requirements I decided to create the Marathon-LDAP Plugin. This article will cover how easy it is to secure your Marathon clusters against an LDAP server.