Run Service Fabric App under Group Managed Service Account (gMSA)

问题

I'm testing using a gMSA account to run an SF app, instead of NETWORKSERVICE.

Following the instructions from here: https://docs.microsoft.com/en-us/azure/service-fabric/service-fabric-application-runas-security

Created the gMSA on the domain controller using the powershell cmdlet:

New-ADServiceAccount -name MySA$ -DnsHostName MySA.contoso -ServicePrincipalNames http/MySA.contoso -PrincipalsAllowedToRetrieveManagedPassword Node0Machine$, Node1Machine$, Node2Machine$

Install-AdServiceAccount returned an "unspecified error" on each of the nodes, however Test-AdServiceAccount returns true for MySA$ (when running powershell as a domain user)

ApplicationManifest.xml has the following changes:

<Principals>
    <Users>
      <User Name="MySA" AccountType="ManagedServiceAccount" AccountName="Contoso\MySA$"/>
</Users>
</Principals>
<Policies>
    <SecurityAccessPolicies>
      <SecurityAccessPolicy ResourceRef="ConfigurationEncipherment" PrincipalRef="MySa" ResourceType="Certificate" />
    </SecurityAccessPolicies>
<DefaultRunAsPolicy UserRef="MySA"/>
</Policies>

The Service Fabric explorer shows the following error for each service:

Error event: SourceId='System.Hosting', Property='CodePackageActivation:Code:SetupEntryPoint'.
There was an error during CodePackage activation.Service host failed to activate. Error:0x8007052e

I have also tried creating the cluster using the gMSA (we are using X509 successfully at the moment). Using the gMSA cluster config as a template, it fails with a timeout (presumably the "WindowsIdentities section is incorrect - there seems to be little documentation on this)

"security": {
    "WindowsIdentities": {
            "ClustergMSAIdentity": "MySA$@contoso",
            "ClusterSPN": "http/MySa.contoso",
            "ClientIdentities": [
                {
                    "Identity": "contoso\\MySA$",
                    "IsAdmin": true
                }
            ]
   },

回答1:

The Error:0x8007052e may be linked to a logon failure.

According to Secure a standalone cluster on Windows by using Windows security and Connect to a secure cluster

If you have more than 10 nodes or for clusters that are likely to grow or shrink. Microsoft strongly recommend using the Group Managed Service Account (gMSA) approach.

You will see also:

You can establish trust in two different ways:

Specify the domain group users that can connect.

Specify the domain node users that can connect.

[...]

Administrators have full access to management capabilities (including read/write capabilities). Users, by default, have only read access to management capabilities (for example, query capabilities), and the ability to resolve applications and services.

You may also find help on Getting Started with Group Managed Service Accounts

According to your comment, as soon as you add the gMSA to the ServiceFabricAdministrators group everything will work and it is probably due to the fact that "administrators have full access to management capabilities"

来源：https://stackoverflow.com/questions/48225870/run-service-fabric-app-under-group-managed-service-account-gmsa

标签

azure-service-fabric