Enabling integrated Windows Authentication in windows docker container

Walk through below will enable integrated Windows Authentication for windows docker container in Active Directory environment.

Overview of steps are below

1. Create Global Security group Container Hosts  in Active Directory
2. Add container host servers to group which is allowed to decrypt password GMSA account
3. Reboot container host so computer account have proper group membership
4. Create GMSA account in Active Directory
5. Install GMSA account on container host
6. Add SPN record to GMSA account
7. Generate credentialspecs file to be passed to docker daemon during container startup
8. Launch docker container with proper parameters

Detailed implementation steps are below

Create Global Security group Container Hosts  in Active Directory

Add computer account for container host to Container Hosts group

Reboot container host computer

This step is required so computer account will have proper AD group associated with it

Create GMSA account in Active Directory

On domain controller execute

	Import-module ActiveDirectory
	Add-KdsRootKey –EffectiveTime ((get-date).addhours(-10));
	New-ADServiceAccount -Name containerhost -DNSHostName servicefabric.ad.local -PrincipalsAllowedToRetrieveManagedPassword "Domain Controllers",
	"domain admins", "CN=Container Hosts,CN=Builtin, DC=ad, DC=local" -KerberosEncryptionType RC4, AES128, AES256

view raw

a.ps1

hosted with ❤ by GitHub

Install GMSA account on container host and test it

	Enable-WindowsOptionalFeature -FeatureName ActiveDirectory-Powershell -online -all
	Get-ADServiceAccount -Identity containerhost
	Install-ADServiceAccount -Identity containerhost
	Test-AdServiceAccount -Identity containerhost

view raw

a.ps1

hosted with ❤ by GitHub

Output shall not contain any errors and will look like below

Path : 
Online : True
RestartNeeded : False

DistinguishedName : CN=containerhost,CN=Managed Service Accounts,DC=ad,DC=local
Enabled : True
Name : containerhost
ObjectClass : msDS-GroupManagedServiceAccount
ObjectGUID : 12941984-5fd3-4095-96f9-cbd96902eb36
SamAccountName : containerhost$
SID : S-1-5-21-3914853822-719528391-929614657-1606
UserPrincipalName :

True

Add SPN record to GMSA account

This step is required if for kerberos authentication to work and for automatic login in Chrome/IE. Without it authentication will still work but will always prompt for username/password since it will fallback to NTLM.

Launch adsiedit.msc on domain controller and add SPN of HTTP/containerhost1.ad.local to GMSA account

Generate credentialspecs file to be passed to docker daemon during container startup

Execute powershell below to generate your GMSA configuration file which will be used by docker to enable Windows Authentication

	Invoke-WebRequest "https://raw.githubusercontent.com/Microsoft/Virtualization-Documentation/live/windows-server-container-tools/ServiceAccounts/CredentialSpec.psm1" -UseBasicParsing -OutFile $env:TEMP\cred.psm1
	import-module $env:temp\cred.psm1
	New-CredentialSpec -Name win -AccountName containerhost
	#This will return location and name of JSON file
	Get-CredentialSpec
	Name Path
	—- —-
	win C:\ProgramData\docker\CredentialSpecs\win.json

view raw

a.ps1

hosted with ❤ by GitHub

 

Launch docker container with proper parameters

Launching docker with parameters specifying GMSA account name as well as credential specs file

docker run -d -p 8080:80 -h containerhost --security-opt "credentialspec=file://win.json" artisticcheese/winauth:servercore

You can use my image artisticcheese/winauth:servercore to test if this solution works. Image has just plain vanilla IIS with windows authentication enabled and default page showing which account are you logged on with. This image is based of 1709 version of Windows Server Core and hence make sure your host is above 1709​.

Now if you access your container host on port 8080 on any domain joined machine you shall be automatically authenticated. If you try to access your containerhost via IP address then you will be prompted for username/password since IE/chrome will assume you are accessing external computer and hence will not automatically log you on.