Running Credential fetcher in Ubuntu environment

[Sachyyy]

Hello,
I am trying to run Credential fetcher on ubuntu environment.
This is a AD joined linux environment.

I tried following the credentials-fetcher configuration guide but failed getting Kerberos Ticket for the gMSA account on the linux machine.

sudo grpc_cli call unix:/var/credentials-fetcher/socket/credentials_fetcher.sock AddKerberosLease "credspec_contents: '{"CmsPlugins":["ActiveDirectory"],"DomainJoinConfig":{"Sid":"S-1-5-21-3036598194-874362413-4262823843","MachineAccountName":"MGSA_DevTS2CSvc","Guid":"6e23677c-00a8-4a89-a589-0ef2847291bf","DnsTreeName":"dev.local","DnsName":"dev.local","NetBiosName":"DEV"},"ActiveDirectoryConfig":{"GroupManagedServiceAccounts":[{"Name":"MGSA_DevTS2CSvc","Scope":"dev.local"},{"Name":"MGSA_DevTS2CSvc","Scope":"DEV"}]}}'"
Method name not found
Failed to find method AddKerberosLease in proto files.
Method name not found
Method name not found
Failed to parse request.
Reflection request not implemented; is the ServerReflection service enabled?

I am working with my colleague who also post another discussion on correctly installing Credential fetcher on Ubuntu.

[sb-ruisms]

Thanks for posting this. Will look into it and keep this thread posted.

[saikiranakula-amzn]

Hi Sachyyy@, Thank you for reaching out to us. When using grpc cli. The formatting need to be very similar to the example provided below.
sudo grpc_cli call unix:/usr/share/credentials-fetcher/socket/credentials_fetcher.sock AddKerberosLease "credspec_contents: '{\"CmsPlugins\":[\"ActiveDirectory\"],\"DomainJoinConfig\":{\"Sid\":\"S-1-5-21-4217655605-3681839426-3493040985\",\"MachineAccountName\":\"WebApp01\",\"Guid\":\"af602f85-d754-4eea-9fa8-fd76810485f1\",\"DnsTreeName\":\"contoso.com\",\"DnsName\":\"contoso.com\",\"NetBiosName\":\"contoso\"},\"ActiveDirectoryConfig\":{\"GroupManagedServiceAccounts\":[{\"Name\":\"WebApp01\",\"Scope\":\"contoso.com\"},{\"Name\":\"WebApp01\",\"Scope\":\"contoso\"}]}}'"
Also, as a sanity check, ensure the credentials-fetcher is running on the host "sudo systemctl status credentials-fetcher", and check the credentials-fetcher.sock is available at "/var/credentials-fetcher/socket"
please try this and keep us posted if this resolves the issue

[smhmhmd]

@Sachyyy
For initial testing, you can also use the test-client.
The test code uses account names webapp01 and webapp02 andcontoso.com as domain.

$ ./api/tests/gmsa_test_client

[Sachyyy]

I did the escaping with the example you provided, still the same.

sudo grpc_cli call unix:/var/credentials-fetcher/socket/credentials_fetcher.sock AddKerberosLease "credspec_contents: '{"CmsPlugins":["ActiveDirectory"],"DomainJoinConfig":{"Sid":"S-1-5-21-3036598194-874362413-4262823843","MachineAccountName":"MGSA_DevTS2CSvc","Guid":"6e23677c-00a8-4a89-a589-0ef2847291bf","DnsTreeName":"dev.local","DnsName":"dev.local","NetBiosName":"DEV"},"ActiveDirectoryConfig":{"GroupManagedServiceAccounts":[{"Name":"MGSA_DevTS2CSvc","Scope":"dev.local"},{"Name":"MGSA_DevTS2CSvc","Scope":"DEV"}]}}'"

Also Credetials Fetcher is running

● credentials-fetcher.service - credentials-fetcher systemd service unit file.
Loaded: loaded (/etc/systemd/system/credentials-fetcher.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2023-11-07 09:47:20 UTC; 2 weeks 0 days ago
Main PID: 713 (credentials-fet)
Status: "Watchdog notify count = 257241"
Tasks: 12 (limit: 9388)
Memory: 16.0M
CPU: 2min 56.267s
CGroup: /system.slice/credentials-fetcher.service
└─713 /usr/sbin/credentials-fetcherd

[Sachyyy]

Does not work. Only one worked was

Environment="CF_GMSA_OU=OU=Dev_MGSAs,OU=Managed Group Service Accounts,OU=System Accounts,OU=DEV"
not sure if I need to escape any characters here.

[smhmhmd]

Does not work. Only one worked was

Do you still have the issue ?

[smhmhmd]

@Sachyyy If you still have the issue, lets have a call tomorrow, you have our email

[Sachyyy]

Yes. Let's have a call tomorrow.
Thank you !

[smhmhmd]

Thanks for reaching out @Sachyyy.
You can close the issue at your convenience.

[saikiranakula-amzn]

Now we have a working environment. Let us know if you guys have any more questions. Thank you :)

[smhmhmd]

Thanks @Sachyyy for the discussion + contribution.