Using GMSA in the Windows container

The company was recently given a test environment involving a component that uses Kerberos authentication to connect to a SQL Server database in a container.

The Windows container itself cannot be joined to a domain, but you can run the container through GMSA to have the GMSA identity of the container process, so that a dozen needs to add this GMSA login to SQL Server to achieve the goal. Note that the GMSA must be used and the normal MSA account will be used in the container.

Before you create your GMSA account for the first time, you need to create a KDS (key distribute Service) root key (such as created to ignore this step):

add-kdsrootkey–effectiveimmediately

Then you need to wait a long 10 hours to complete the copy of the key ... Well, if you're doing an experiment, you can omit this for 10 hours:

Add-kdsrootkey–effectivetime ((get-date). AddHours (-10))

Create GMSA:

New-adserviceaccount-name Service1-dnshostname Service1.contoso.com-principalsallowedtoretrievemanagedpassword [ computername1$, computername2$ ...] -kerberosencryptiontype RC4, AES128, AES256

Where -dnshostname is just a group name and does not need to be added to your DNS. -principalsallowedtoretrievemanagedpassword is the server name of your container, note that the computer name on the AD is also an account, so add "$" to the rear.

Next, install GMSA on the container's host

1 // Install PowerShell Module  2 install-windowsfeature rsat-ad-PowerShell  3 4 // installation GMSA  5 install-adserviceaccount Service1  6  7 // Test  8 test-adserviceaccount Service1  9 //display "True" test passed

Next, to use GMSA in the container, you need to create credentialspec for Docker, we need credentialspec.psm1 in Virtualization-documentation, which Virtualization-documentation/windows-server-container-tools/serviceaccounts, you can choose to clone the whole project or create a new name Credentialspec.psm1 text file, and then glue the contents of the file. Then, execute the following PS command:

1 import-module./credentialspec.psm12 new-credentialspec-name service1-accountname Service1

Next, you can run the container:

" Credentialspec=file://service1.json " Microsoft/windowsservercore Nltest/parentdomain

Output your AD name, stating that the run was successful.

Using GMSA in the Windows container