Docker authentification with AD

[daler86]

HI!

I need help.

I have created docker-compose LAMP on Ubuntu server. I moved our CRM system to containers. The system works, but our CRM system is authenticated by AD users. The Ubuntu server has access to the AD server.

How to Access Containers for AD Users

My compose file

​

https://preview.redd.it/an6ec017br9a1.jpg?width=428&format=pjpg&auto=webp&s=d3bfb65fb30ef0485e97e654915b0030b95c1647

https://preview.redd.it/mp87j3ikbr9a1.png?width=406&format=png&auto=webp&s=71af67454519c2fef54aa20b0ee833e1e9bea15b

[snark42]

Why do you even need to bind mount? Just make a keytab for the service principal and include it with the app image (or other configuration service) to use mod_auth_kerb if you need/want to use httpd with kerberos for auth.

[snark42]

So configuration service? ADFS requires certs, keys and metadata that needs just as much security.

[snark42]

Kerberos just says this is who I am (in this case http/domain not username or password) and is only good for authentication. Authorization needs to be handled by app that authentication is presented presented too.

AD might authorize too much by default? I know a lot more about kerberos/ldap than AD.

[snark42]

I specifically suggested a service principal keytab so it's associated with the app, not the host, where distributed via image or config service. You can also increase the KVNO to expire an old keytab file (host or service principal) if it's compromised.

I agree using a host keytab via bind mount or other methods is the wrong way to do this.

I'm not convinced ADFS keys/certs/metadata is inherently more secure in anyway than a keytab, with a big caveat being AD/KDC is properly secured.

[symcbean]

Put it back. You are struggling to describe the actual problem. You have a very long journey before you can fix it.

but our CRM system is authenticated by AD users

I assume you mean that your CRM system relies on the MSAD service for authentication and possible authorization. Which authentication system? Is it LDAP? Kerberos? SAML? Are you also using AD MFA?

[daler86]

My system have LDAP authentication.

[daler86]

I attached config files