|
| 1 | +# Experiments to get gMSA Container Credentials Manager working. |
| 2 | + |
| 3 | +### Goal: |
| 4 | + |
| 5 | +Implement a C# plugin that is invoked by CCM to provide credentials for container launch on non-domain joined machine. The process is documented in the following articles: |
| 6 | + |
| 7 | +https://docs.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts |
| 8 | + |
| 9 | +https://docs.microsoft.com/en-us/windows/win32/api/ccgplugins/nf-ccgplugins-iccgdomainauthcredentials-getpasswordcredentials |
| 10 | + |
| 11 | +### Current problem: |
| 12 | + |
| 13 | +Cannot get CCM to activate COM component |
| 14 | + |
| 15 | +### What has been tried: |
| 16 | + |
| 17 | +1. Implemented COM interface as C# project |
| 18 | + |
| 19 | +2. Compile in x64 mode (Debug config) |
| 20 | + |
| 21 | +3. Register to COM from `bin\Debug` folder via `C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe CcgPlugin.dll /tlb /codebase` |
| 22 | + |
| 23 | +4. Add COM registration to CCG |
| 24 | + |
| 25 | + ``` |
| 26 | + Windows Registry Editor Version 5.00 |
| 27 | + |
| 28 | + [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\CCG\COMClasses\{DEFFF03C-3245-465F-8391-CC586A2D1F32}] |
| 29 | + ``` |
| 30 | + |
| 31 | + |
| 32 | + |
| 33 | +5. Place `ccg.json` into `C:\ProgramData\Docker\credentialspecs` |
| 34 | + |
| 35 | +6. Try to start container with `docker run --security-opt "credentialspec=file://ccg.json" --hostname webapp01 -it mcr.microsoft.com/windows/servercore:ltsc2019 powershell` |
| 36 | + |
| 37 | +### Expected result: |
| 38 | + |
| 39 | +1. Some kinda logs created in `c:\temp` (first on component activation, and method invocation) |
| 40 | + |
| 41 | +### Actual result: |
| 42 | + |
| 43 | +1. No logs in `c:\temp` |
| 44 | + |
| 45 | +## Additional info |
| 46 | + |
| 47 | +### Validate COM registration |
| 48 | + |
| 49 | +COM registration seems to be successful, as it can be activated like this: |
| 50 | + |
| 51 | +```c# |
| 52 | + var otherType = Type.GetTypeFromCLSID(new Guid("DEFFF03C-3245-465F-8391-CC586A2D1F32")); |
| 53 | +var otherInstance = Activator.CreateInstance(otherType).Dump(); |
| 54 | +object[] args = new object[] { "test","","","" }; |
| 55 | +ParameterModifier pMod = new ParameterModifier(4); |
| 56 | +pMod[1] = true; |
| 57 | +pMod[2] = true; |
| 58 | +pMod[3] = true; |
| 59 | +ParameterModifier[] mods = { pMod }; |
| 60 | + |
| 61 | +otherType.InvokeMember("GetPasswordCredentials", BindingFlags.InvokeMethod | BindingFlags.NonPublic | BindingFlags.Public , null, otherInstance, args, mods, null, null); |
| 62 | + |
1 | 63 | ``` |
2 | | -bin\Debug> tlbexp CcgPlugin.dll |
3 | | -regasm CcgPlugin.dll /tlb:CcgPlugin.tlb |
4 | | -``` |
5 | 64 |
|
| 65 | +### Confirm correct COM signature |
| 66 | + |
| 67 | +1. Windows SDK installed to get original `IDL` for `ccgplugins`. Necessary files are in `C:\Program Files (x86)\Windows Kits\10\Include\10.0.20348.0\um` |
| 68 | + |
| 69 | +2. IDL converted to `TLB` as following: |
| 70 | + |
| 71 | + ``` |
| 72 | + midl ccgplugins-lib.idl /tlb ccgplugins.tlb |
| 73 | + |
| 74 | + ``` |
| 75 | + |
| 76 | +3. `TLB` converted to `.NET` assembly DLL via `tlbimp ccgplugins.tlb /out:ccgplugins-net.dll` |
| 77 | + |
| 78 | + ``` |
| 79 | + tlbimp ccgplugins.tlb /out:ccgplugins-net.dll |
| 80 | + ``` |
| 81 | + |
| 82 | +4. Reverse decompilation of the resulting DLL via Jetbrains DotPeek confirms that the correct signature for the interface as: |
| 83 | + |
| 84 | + ```c# |
| 85 | + namespace ccgplugins\u002Dnet |
| 86 | + { |
| 87 | + [Guid("6ECDA518-2010-4437-8BC3-46E752B7B172")] |
| 88 | + [InterfaceType(ComInterfaceType.InterfaceIsIUnknown)] |
| 89 | + [ComImport] |
| 90 | + public interface ICcgDomainAuthCredentials |
| 91 | + { |
| 92 | + [MethodImpl(MethodImplOptions.InternalCall, MethodCodeType = MethodCodeType.Runtime)] |
| 93 | + void GetPasswordCredentials( |
| 94 | + [MarshalAs(UnmanagedType.LPWStr), In] string pluginInput, |
| 95 | + [MarshalAs(UnmanagedType.LPWStr)] out string domainName, |
| 96 | + [MarshalAs(UnmanagedType.LPWStr)] out string username, |
| 97 | + [MarshalAs(UnmanagedType.LPWStr)] out string password); |
| 98 | + } |
| 99 | + } |
| 100 | + |
| 101 | + ``` |
| 102 | + |
| 103 | + |
6 | 104 |
|
| 105 | +### AKS plugin |
7 | 106 |
|
| 107 | +It was confirmed that AKS plugin that implements the above interface does work and is able to be spun up and start container with GMSA creds as per this article. https://docs.microsoft.com/en-us/azure/aks/use-group-managed-service-accounts |
0 commit comments