You can grant users access to the Mesos UI. By default, new users have no permissions.

Grant Access by using the GUI

Prerequisite:

• A DC/OS user account without the dcos:superuser permission.

1. Log into the DC/OS GUI as a user with the dcos:superuser permission.

   

   Figure 1. DC/OS web interface login

2. Select Organization and choose Users or Groups.

3. Select the name of the user or group to grant the permission to.

   

   Figure 2. Select user or group to grant permissions to

4. From the Permissions tab, click ADD PERMISSION.

5. Click INSERT PERMISSION STRING to toggle the dialog.

   

   Figure 3. Insert Permission String

6. Copy and paste the permission in the Permissions Strings field. Choose the permission strings based on your security mode and click ADD PERMISSIONS and then Close.

   Permissive

   Mesos master UI and API

   dcos:adminrouter:ops:mesos full
   

   Mesos agent API for accessing task sandboxes and logs, and task exec

   dcos:adminrouter:ops:slave full
   

   Strict

   Mesos master UI and API

   dcos:adminrouter:ops:mesos full
   

   Mesos agent API for accessing task sandboxes and logs, and task exec

   dcos:adminrouter:ops:slave full
   

You can now send the URL of the Mesos UI for DC/OS to the user: http://<master-public-ip>/mesos/.

Granting Access by using the API

Prerequisites:

• You must have the DC/OS CLI installed and be logged in as a superuser.
• You must get the root cert before issuing the curl commands in this section.

Tips:

• Service resources often include / characters that must be replaced with %252F in curl requests, as shown in the examples below.
• When using the API to manage permissions, you must create the permission before granting it. If the permission already exists, the API will return an informative message and you can continue to assign the permission.

Permissive

Mesos master UI and API

1. Create the permission.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   -H 'Content-Type: application/json' \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:mesos \
   -d '{"description":"Grants access to the Mesos master API/UI and task details"}'
   

2. Grant the following privileges to the user uid.

   curl -X PUT --cacert dcos-ca.crt -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:mesos/users/<uid>/full
   

NOTE: To grant this permission to a group instead of a user, replace /users/"uid" with /groups/"gid".

1. You can send the URL of the Mesos UI for DC/OS to the user: http://<master-public-ip>/mesos/.

Mesos agent API for accessing task sandboxes and logs, and task exec

1. Create the permission.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   -H 'Content-Type: application/json' \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:slave \
   -d '{"description":"Grants access to the Mesos agent API/UI and task details such as logs"}'
   

2. Grant the following privileges to the user uid.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:slave/users/<uid>/full
   

NOTE: To grant this permission to a group instead of a user, replace /users/"uid" with /groups/"gid".

Strict

Mesos master UI and API

1. Create the permission.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   -H  'Content-Type: application/json' \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:mesos \
   -d '{"description":"Grants access to the Mesos master API/UI and task details"}'
   

2. Grant the following privileges to the user uid.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:mesos/users/<uid>/full
   

   NOTE: To grant this permission to a group instead of a user, replace /users/"uid" with /groups/"gid".

3. You can send the URL of the Mesos UI for DC/OS to the user: http://<master-public-ip>/mesos/.

Mesos agent API for accessing task sandboxes and logs, and task exec

1. Create the permission.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   -H 'Content-Type: application/json' \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:slave \
   -d '{"description":"Grants access to the Mesos agent API/UI and task details such as logs"}'
   

2. Grant the following privileges to the user uid.

   curl -X PUT --cacert dcos-ca.crt \
   -H "Authorization: token=$(dcos config show core.dcos_acs_token)" \
   $(dcos config show core.dcos_url)/acs/api/v1/acls/dcos:adminrouter:ops:slave/users/<uid>/full
   

NOTE: To grant this permission to a group instead of a user, replace /users/"uid" with /groups/"gid".