Jtdylktuy

I have setup an IIS inside a container and I can use the host's IIS to connect to that "server".

Next step, I need to host a web application inside (I have successfully done it if the web is not related to AD)

The case is, our web applications need to be authenicated using our ad accounts and now, if I start the web inside the container, even I type the correct account + pw, it still gives me

401 - Unauthorized: Access is denied due to invalid credentials.

So... how to use AD inside a container?

As told by
https://blogs.msdn.microsoft.com/containerstuff/2017/01/30/create-a-container-with-active-directory-support/

I have came across gMSA

1. 
   

   I logged in to the AD server and run:

   
   
   

   New-ADServiceAccount -Name ABC -PrincipalsAllowedToRetrieveManagedPassword ABC-Servers –DNSHostName ABC.domain.com
   
   

   
   


2. 
   

   I went to the server with Docker installed and run:

   
   
   

   Import-Module ./CredentialSpec.psm1
   
   New-CredentialSpec -Name ABC -AccountName ABC
   
   

   
   


3. 
   

   start a new container with

   
   
   

   --security-opt 
   
   

   
   

and

    ABC.json

But in the end, it still requires me to authenticate my-self and no matter what I typed, all 401...

btw, nltest /parentdomain shows me the ad server name

I have solved it. I have missed the setspn and -h part

Part of this solution is related to these links:
https://blogs.msdn.microsoft.com/containerstuff/2017/07/31/getting-iis-win-auth-to-work-in-a-container/

https://blogs.msdn.microsoft.com/containerstuff/2017/01/30/create-a-container-with-active-directory-support/

The hostname of the host machine = abcHost (confirm by running hostname in cmd)

To have it done, firstly, as I mentioned:
1. Log in to the AD server and run:

New-ADServiceAccount -Name accountABC -PrincipalsAllowedToRetrieveManagedPassword ABC-Servers –DNSHostName abcHost.domain.com

2. Go to the server with Docker installed (host machine) and run:
   Import-Module ./CredentialSpec.psm1
   New-CredentialSpec -Name accountABC -AccountName accountABC

So, we now have a service account : ABC
And the next step is to link the machine name with the service account, therefore run setspn in the ad server:

setspn -c -s HTTP/abcHost domianaccountABC

Afterthat, to have the container run with the service account, we need to add -h option in Docker run. together with the gMSA account created before, the command will be:

Docker run -it --name accountABC -h accountABC -v <a directory> --security-opt "credentialspec=file://accountABC.json" myImage

Then, for IIS application, that select that "server or container" in "Connections" Panel > Feature Delegration > set all "Authentication - SOMETHING" to Read/Write

Then it is done