This is a continuation of the previous blog post on GMSA setup.

Step 1: Create Docker Image

1. I have created ASPNET MVC app and it accessing the SQL server using windows authentication.
2. My Connection string looks like below.

    
                   
                   <connectionStrings>
                   <add name="AdventureWorks2012Entities"
                   connectionString="metadata=res://*/ManagerEmployeeModel.csdl|res://*/ManagerEmployee
                   Model.ssdl|res://*/ManagerEmployeeModel.msl;provider=System.Data.SqlClient;provider 
                   connection string=&quot;data source=CIQSQL2012;initial
                   catalog=AdventureWorks2012;integrated
                   security=True;MultipleActiveResultSets=True;App=EntityFramework&quot;"
                   providerName="System.Data.EntityClient" />
                   </connectionStrings>
                    

3. I have created the Docker file and necessary build folders using image2docker. Refer Image2Docker
   

   

4. Docker file looks like below

    
                   
                   # escape=` 
                   FROM microsoft/aspnet:3.5-windowsservercore-10.0.14393.1066 
                   SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; 
                   $ProgressPreference = 'SilentlyContinue';"] 
                    
                   # disable DNS cache so container addresses always fetched from Docker 
                   RUN Set-ItemProperty -path 'HKLM:\SYSTEM\CurrentControlSet\Services\Dnscache\
                   Parameters' -Name ServerPriorityTimeLimit -Value 0 -Type DWord 
                    
                   RUN Remove-Website 'Default Web Site'; 
                    
                   RUN Enable-WindowsOptionalFeature -Online -FeatureName IIS-ApplicationDevelopment,
                   IIS-ASPNET,IIS-ASPNET45,IIS-CommonHttpFeatures,IIS-DefaultDocument,
                   IIS-DirectoryBrowsing,IIS-HealthAndDiagnostics,IIS-HttpCompressionStatic,
                   IIS-HttpErrors,IIS-HttpLogging,IIS-ISAPIExtensions,IIS-ISAPIFilter,
                   IIS-NetFxExtensibility,IIS-NetFxExtensibility45,IIS-Performance,IIS-RequestFiltering,
                   IIS-Security,IIS-StaticContent,IIS-WebServer,IIS-WebServerRole,NetFx4Extended-ASPNET45 
                    
                   # Set up website: MyGSMAMvc 
                   RUN New-Item -Path 'C:\inetpub\wwwroot\MyAspNetMVC_GSMA' -Type Directory -Force;  
                    
                   RUN New-Website -Name 'MyGSMAMvc' -PhysicalPath 'C:\inetpub\wwwroot\MyAspNetMVC_GSMA' -Port 80 -Force;  
                    
                   EXPOSE 80 
                    
                   COPY ["MyAspNetMVC_GSMA", "/inetpub/wwwroot/MyAspNetMVC_GSMA"] 
                    
                   RUN $path='C:\inetpub\wwwroot\MyAspNetMVC_GSMA'; ` 
                       $acl = Get-Acl $path; ` 
                       $newOwner = [System.Security.Principal.NTAccount]('BUILTIN\IIS_IUSRS'); ` 
                       $acl.SetOwner($newOwner); ` 
                       dir -r $path | Set-Acl -aclobject  $acl 
                   
                    

5. Move the necessary files to cloud-2016.
6. Login to the cloud-2016 server.
7. Create the image using the below commands. Refer Docker commands.

    
                   
                   docker build -t myaspnetmvc/gmsa  

Step 2: Create Container

1. when you are creating docker container you need to specify the additional configuration to utilize GMSA. Please execute below commands

    
                   
                   docker run -d --security-opt "credentialspec=file://Gmsa.json" myaspnetmvc/gmsa 

2. Or execute the commands below

    
                    $id = docker run -d --security-opt "credentialspec=file://Gmsa.json" myaspnetmvc/gmsa docker logs $id
                   $ip = docker inspect --format '{{ .NetworkSettings.Networks.nat.IPAddress }}' $id start http://$($ip)
                    

3. Browse the appropriate page, you can see DB records.
4. You can test the Active directory communication below. 
   1. Login into running docker container using docker exec command and check if, in fact, you can communicate to Active Directory. Execute nltest /parentdomain to verify

       
                      docker exec -it 0974d72624eb powershell 
                      nltest /parentdomain 
                      cloudiq.local. (1) 
                      The command completed successfully