A RetroSearch Logo

Home - News ( United States | United Kingdom | Italy | Germany ) - Football scores

Search Query:

Showing content from https://github.com/aws/credentials-fetcher below:

aws/credentials-fetcher: Credentials-fetcher is a Linux daemon that retrieves gMSA credentials from Active Directory over LDAP. It creates and refreshes kerberos tickets from gMSA credentials. Kerberos tickets can be used by containers to run apps/services that authenticate using Active Directory.

credentials-fetcher is a Linux daemon that retrieves gMSA credentials from Active Directory over LDAP. It creates and refreshes kerberos tickets from gMSA credentials. Kerberos tickets can be used by containers to run apps/services that authenticate using Active Directory.

This daemon works in a similar way as ccg.exe and the gMSA plugin in Windows as described in - https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts#gmsa-architecture-and-improvements

Create credentialspec associated with gMSA account:

To start a local dev environment from scratch:

* Clone the Git repository.
* cd credentials-fetcher && mkdir build
* cd build && cmake ../ && make -j && make install 
* ./credentials-fetcherd to start the program in non-daemon mode.

Logs about request/response to the daemon and any failures.

journalctl -u credentials-fetcher
Default environment variables Environment Key Examples values Description CF_KRB_DIR '/var/credentials-fetcher/krbdir' (Default) Dir path for storing the kerberos tickets CF_UNIX_DOMAIN_SOCKET_DIR '/var/credentials-fetcher/socket' (Default) Dir path for the domain socker for gRPC communication 'credentials_fetcher.sock' CF_LOGGING_DIR '/var/credentials-fetcher/logging' (Default) Dir Path for log CF_TEST_DOMAIN_NAME 'contoso.com' Test domain name CF_TEST_GMSA_ACCOUNT 'webapp01' Test gMSA account name Runtime environment variables Environment Variable Examples values Description CF_CRED_SPEC_FILE '/var/credentials-fetcher/my-credspec.json' Path to a credential spec file used as input. (Lease id default: credspec) '/var/credentials-fetcher/my-credspec.json:myLeaseId' An optional lease id specified after a colon CF_GMSA_OU 'CN=Managed Service Accounts' Component of GMSA distinguished name (see docs/cf_gmsa_ou.md) Test using Personal CDK Stack

Use the AWS CDK to create

Test APIs using Integration Test Script

/api/tests/gmsa_api_integration_test.cpp contains integration tests for the of the gMSA APIs.

Follow the instructions in the Domainless Mode README to set up the required infrastructure for testing gMSA on Linux containers.

Set AWS environment variables

export AWS_ACCESS_KEY_ID=XXXX
export AWS_SECRET_ACCESS_KEY=XXXX
export AWS_SESSION_TOKEN=XXXX
export AWS_REGION=XXXX

Set Amazon S3 ARN containing the credential spec file.

export CF_TEST_CREDSPEC_ARN=XXX

Set standard username, password and domain used for testing

export CF_TEST_STANDARD_USERNAME=XXXX
export CF_TEST_STANDARD_USER_PASSWORD=XXXX
export CF_TEST_DOMAIN=XXXX

Follow the instructions from Standalone mode sections to build the code with the integration test flag enabled, generate binaries and start the server. Once the server has started, run integration tests

cd credentials-fetcher/build/
cmake -DBUILD_INTEGRATION_TESTS=ON .. && make -j
# Start the server from another terminal and run `sudo ./credentials-fetcherd`
sudo -E api/tests/gmsa_api_integration_test 

> sudo api/tests/gmsa_api_integration_test 
[==========] Running 6 tests from 1 test suite.
[----------] Global test environment set-up.
[----------] 6 tests from GmsaIntegrationTest
[ RUN      ] GmsaIntegrationTest.HealthCheck_Test
[       OK ] GmsaIntegrationTest.HealthCheck_Test (4 ms)
[ RUN      ] GmsaIntegrationTest.A_AddNonDomainJoinedKerberosLeaseMethod_Test
[       OK ] GmsaIntegrationTest.A_AddNonDomainJoinedKerberosLeaseMethod_Test (1028 ms)
[ RUN      ] GmsaIntegrationTest.B_RenewNonDomainJoinedKerberosLeaseMethod_Test
[       OK ] GmsaIntegrationTest.B_RenewNonDomainJoinedKerberosLeaseMethod_Test (553 ms)
[ RUN      ] GmsaIntegrationTest.C_DeleteKerberosLeaseMethod_Test
[       OK ] GmsaIntegrationTest.C_DeleteKerberosLeaseMethod_Test (7 ms)
[ RUN      ] GmsaIntegrationTest.A_AddKerberosArnLeaseMethod_Test
[       OK ] GmsaIntegrationTest.A_AddKerberosArnLeaseMethod_Test (768 ms)
[ RUN      ] GmsaIntegrationTest.B_RenewKerberosArnLeaseMethod_Test
[       OK ] GmsaIntegrationTest.B_RenewKerberosArnLeaseMethod_Test (691 ms)
[----------] 6 tests from GmsaIntegrationTest (3054 ms total)

[----------] Global test environment tear-down
[==========] 6 tests from 1 test suite ran. (3054 ms total)
[  PASSED  ] 6 tests.
Testing Tips without using CDK stack or Test Scripts

To communicate with the daemon over gRPC, install grpc-cli. For example sudo yum install grpc-cli

Note: APIs use unix domain socket

Invoke the AddkerberosLease API with the credentialsspec input as shown:
grpc_cli call {unix_domain_socket} AddKerberosLease "credspec_contents: '{credentialspec}'"

Sample:
grpc_cli call unix:/var/credentials-fetcher/socket/credentials_fetcher.sock
AddKerberosLease "credspec_contents: '{\"CmsPlugins\":[\"ActiveDirectory\"],\"DomainJoinConfig\":{\"Sid\":\"S-1-5-21-4217655605-3681839426-3493040985\",
\"MachineAccountName\":\"WebApp01\",\"Guid\":\"af602f85-d754-4eea-9fa8-fd76810485f1\",\"DnsTreeName\":\"contoso.com\",
\"DnsName\":\"contoso.com\",\"NetBiosName\":\"contoso\"},\"ActiveDirectoryConfig\":{\"GroupManagedServiceAccounts\":[{\"Name\":\"WebApp01\",\"Scope\":\"contoso.com\"}
,{\"Name\":\"WebApp01\",\"Scope\":\"contoso\"}]}}'"

* Response:
  lease_id - unique identifier associated to the request
  created_kerberos_file_paths - Paths associated to the Kerberos tickets created corresponding to the gMSA accounts

Invoke the Delete kerberosLease API with lease id input as shown:
grpc_cli call {unix_domain_socket} DeleteKerberosLease "lease_id: '{lease_id}'"

Sample:
grpc_cli call unix:/var/credentials-fetcher/socket/credentials_fetcher.sock DeleteKerberosLease "lease_id: '${response_lease_id_from_add_kerberos_lease}'"

* Response:
    lease_id - unique identifier associated to the request
    deleted_kerberos_file_paths - Paths associated to the Kerberos tickets deleted corresponding to the gMSA accounts
Testing with Active Directory domain-joined mode (opensource)

Credentials-fetcher in domainless mode assuming gMSA account 'WebApp01' has been setup as per https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts#use-case-for-creating-gmsa-account-for-domain-joined-container-hosts

Testing with Active Directory domainless mode (opensource )

Credentials-fetcher in domainless mode assuming gMSA account 'WebApp01' has been setup as per https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts#use-case-for-creating-gmsa-account-for-non-domain-joined-container-hosts ( Please substitute username, secret and password as needed)

#  cat credentials_fetcher_client.py

    import grpc
    import credentialsfetcher_pb2
    import credentialsfetcher_pb2_grpc

    def run():
        with grpc.insecure_channel('unix:///var/credentials-fetcher/socket/credentials_fetcher.sock') as channel:
            stub = credentialsfetcher_pb2_grpc.CredentialsFetcherServiceStub(channel)
            credspec_contents="{\"CmsPlugins\":[\"ActiveDirectory\"],\"DomainJoinConfig\":{\"Sid\":\"S-1-5-21-2725122404-4129967127-2630707939\",\"MachineAccountName\":\"WebApp01\",\"Guid\":\"e96e0e09-9305-462f-9e44-8a8179722897\",\"DnsTreeName\":\"contoso.com\",\"DnsName\":\"contoso.com\",\"NetBiosName\":\"contoso\"},\"ActiveDirectoryConfig\":{\"GroupManagedServiceAccounts\":[{\"Name\":\"WebApp01\",\"Scope\":\"contoso.com\"},{\"Name\":\"WebApp01\",\"Scope\":\"contoso\"}]}}"
            contents = []
            contents += [credspec_contents]
            response = stub.AddNonDomainJoinedKerberosLease(credentialsfetcher_pb2.CreateNonDomainJoinedKerberosLeaseRequest(credspec_contents = contents, username="admin", password="mypassword", domain="contoso.com"))
            print(f"Server response: {response}")

    if __name__ == '__main__':
        run()

On Amazon Linux 2023, only Linux x86_64 architecture is supported. Running the Credentials-fetcher outside of Linux distributions is not supported.

Contributions and feedback are welcome! Proposals and pull requests will be considered and responded to. For more information, see the CONTRIBUTING.md file. If you have a bug/and issue around the behavior of the credentials-fetcher, please open it here.

Amazon Web Services does not currently provide support for modified copies of this software.

If you think you’ve found a potential security issue, please do not post it in the Issues. Instead, please follow the instructions here or email AWS security directly.

The Credentials Fetcher is licensed under the Apache 2.0 License. See LICENSE and NOTICE for more information.

RetroSearch is an open source project built by @garambo | Open a GitHub Issue

Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo

HTML: 3.2 | Encoding: UTF-8 | Version: 0.7.4