Windows Auth to external SQL DB from Docker ASP.Net

Константин 0
Viewed 67

I have Asp.net Project which is deployed through Docker Compose. The deployed application uses an external MS Sql database

If you deploy Asp.net Project locally, then the appsetting looks like using Windows Authentication:

{
  "ConnectionStrings": {
     "Database": "Data Source=name.server;Initial Catalog=name_base_dev;Integrated Security=True;MultipleActiveResultSets=True;"
  },
  "DetailedErrors": true,
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  }
}

However, if I deploy the Asp.net Project to Docker containers, I had to modify the appsetting because it doesn’t work otherwise (no database access) as:

{
  "ConnectionStrings": {
     "Database": "Data Source=name.server;Initial Catalog=name_base_dev;**User Id=name_user;Password=BigPassword**;MultipleActiveResultSets=True;"
  },
  "DetailedErrors": true,
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  }
}

And all I see in docker container logs is this:

> Executing task: docker logs --tail 1000 -f d7d7fb508f6a0135b18ccfc40eecff1e3bab7e0cbcfdd6506d5d089acf5cd176 <

info: ProtoBuf.Grpc.Server.ServicesExtensions.CodeFirstServiceMethodProvider[0]
      RPC services being provided by Name_project.WebUi.Services.ApiService: 5
warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
      Storing keys in a directory '/root/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed.
info: Microsoft.EntityFrameworkCore.Infrastructure[10403]
      Entity Framework Core 6.0.6 initialized 'Name_DbContext' using provider 'Microsoft.EntityFrameworkCore.SqlServer:6.0.6' with options: MigrationsAssembly=Name_project.Persistence
info: ProtoBuf.Grpc.Server.ServicesExtensions.CodeFirstServiceMethodProvider[0]
      RPC services being provided by Name_project.WebUi.Services.ApiService: 5
warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
      Storing keys in a directory '/root/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed.
info: Microsoft.EntityFrameworkCore.Infrastructure[10403]
      Entity Framework Core 6.0.6 initialized 'Name_DbContext' using provider 'Microsoft.EntityFrameworkCore.SqlServer:6.0.6' with options: MigrationsAssembly=Name_project.Persistence
info: ProtoBuf.Grpc.Server.ServicesExtensions.CodeFirstServiceMethodProvider[0]
      RPC services being provided by Name_project.WebUi.Services.ApiService: 5
warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
      Storing keys in a directory '/root/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed.
info: Microsoft.EntityFrameworkCore.Infrastructure[10403]
      Entity Framework Core 6.0.6 initialized 'Name_DbContext' using provider 'Microsoft.EntityFrameworkCore.SqlServer:6.0.6' with options: MigrationsAssembly=Name_project.Persistence

Terminal will be reused by tasks, press any key to close it.

Help understand how to enable Windows Authentication for an Asp.net application deployed in Docker container. Tried to specify Integrated Security=SSPI, also does not help.

Updated 1

If I try to execute a command inside the container kinit nameuser -V -k -t /app/nameuser.keytab , then I get Authenticated to Kerberos v5

root@14f08a183079:/app# kinit nameuser -V -k -t /app/nameuser.keytab
Using default cache: /tmp/krb5cc_0
Using principal: nameuser@DOMAIN.LOCALL
Using keytab: /app/nameuser.keytab
Authenticated to Kerberos v5

root@14f08a183079:/app# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: nameuser@DOMAIN.LOCAL

Valid starting     Expires            Service principal
09/15/22 15:30:47  09/16/22 01:30:47  krbtgt/DOMAIN.LOCAL@DOMAIN.LOCAL
        renew until 09/22/22 15:29:47

root@14f08a183079:/app# kinit nameuser

If I try to run from Dockerfile, get in log app:

Start service
Using default cache: /tmp/krb5cc_0
Using principal: nameuser@DOMAIN.LOCAL
Using keytab: /app/nameuser.keytab
' not found while getting initial credentialsile '/app/nameuser.keytab

And all I see in docker container logs is this:

Using default cache: /tmp/krb5cc_0
Using principal: nameuser@DOMAIN.LOCAL
Using keytab: /app/nameuser.keytab
' not found while getting initial credentialsile '/app/nameuser.keytab
info: ProtoBuf.Grpc.Server.ServicesExtensions.CodeFirstServiceMethodProvider[0]
      RPC services being provided by MyProject.WebUi.Services.ApiService: 5
warn: Microsoft.AspNetCore.DataProtection.Repositories.FileSystemXmlRepository[60]
      Storing keys in a directory '/root/.aspnet/DataProtection-Keys' that may not be persisted outside of the container. Protected data will be unavailable when container is destroyed.
info: Microsoft.EntityFrameworkCore.Infrastructure[10403]
      Entity Framework Core 6.0.6 initialized 'ProjectDbContext' using provider 'Microsoft.EntityFrameworkCore.SqlServer:6.0.6' with options: MigrationsAssembly=MyProject.Persistence
Segmentation fault

Can You Help Me ?

asp.net c# docker
1 Answers

You can't use Integrated Security by default from within a Docker container.

Your application does not run on Windows, it runs in Docker (probably Linux). Even if you'd use a Windows base image, that container is not in your domain, and/or it doesn't know about your SQL Server's host machine's Windows users, so it can't authenticate.

You can let the container use Kerberos to let it act like it belongs in the domain, but then you'll need to modify your Docker image so it does that.

See for example Code Project: Authenticate .NET Core Client of SQL Server with Integrated Security from Linux Docker Container and MS Docs: Understanding Active Directory authentication for SQL Server on Linux and containers.

CodeCaster0
Related