Welcome to the Centrify Express forums.
Note: We are not Mesos Fetcher SMEs.
Please note that we always ask folks to give us the version of CentrifyDC (adinfo -v) and the OS they're running. It's much eaiser to provide you with the best answer if we have this info.
Do you know if Mesos uses:
a) Name Service Switch - this is the way the app will be able to identify users/groups coming from AD via Centrify.
Inspect the /etc/nsswitch.confand see the entries for passwd and group. If the app does not conform to this framework it won't be able to work. In addition, you mentioned switch user (su), this program is NSS-aware and you should be able to use su with any AD user.
b) Pluggable Authentication Modules - this is the way the app would be able to use the authentication stack (unless something else like SASL is needed). Let's continue with the switch user (su) example. su is able to authenticate AD users because when you look at /etc/pam.d/su most likely it has the system's entries that include Centrify's directives.
Finally, the target system needs to know about the users in question, so both the client and the server should be aware of the users, therefore both systems must be joined using Centrify.
That's the prescription I can give you, the client is working fine in your system; the research is about integrating Apache Mesos. If the solution uses different frameworks, then that's a different story.
R.P