vrapolinario/gmsasampleapp repository overview

⁠gMSA sample app

This is a sample application running on Windows containers, simulating an IIS application which tries to authenticate against a Domain controller in Active Directory. This sample is supposed to be used as part of a deployment of gMSA. It can be used on a single node running Windows containers only, generic Kubernetes installation, Azure Kubernetes Service, or any other cloud provider - as long as gMSA is properly enabled. If you configured gMSA in your environment and doesn't have an app to validate if the authentication is working, you can use the app in this image for that. Simply deploy it and you can check if the validation works or not.

⁠How to use this image

• On a single node: Configure gMSA according to the Microsoft documentation⁠, deploy the container with:

docker run --security-opt "credentialspec=file://<credentialspec>.json" --hostname <hostname> -d -p 8080:80 vrapolinario/gmsasampleapp:ltsc2022

Open a browser and open http://127.0.0.1:8080/app⁠. You should see a dialog box to provide your credentials. Provide the credentials you configured on your Active Directory and the page should show the resulting authentication.

• On Kubernetes: For a Kubernetes deployment you will need a YAML specification. You can either create one or leverage the one prepared on the same GitHub⁠ on which we published the dockerfiles.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: gmsalm-demo
  labels:
    app: gmsalm-demo
spec:
  replicas: 1
  template:
    metadata:
      name: gmsalm-demo
      labels:
        app: gmsalm-demo
    spec:
      nodeSelector:
        "kubernetes.io/os": windows
      securityContext:
        windowsOptions:
          gmsaCredentialSpecName: <credential spec name>
      containers:
      - name: gmsalm-demo
        image: vrapolinario/gmsasampleapp:ltsc2022
        imagePullPolicy: IfNotPresent
        ports:
          - containerPort: 80
  selector:
    matchLabels:
      app: gmsalm-demo
---
apiVersion: v1
kind: Service
metadata:
  labels:
    app: gmsalm-demo
  name: gmsalm-demo
  namespace: default
spec:
  ports:
    - port: 80
      targetPort: 80
  selector:
    app: gmsalm-demo
  type: LoadBalancer

The above spec will deploy the pod running this container image and a service, exposing an external IP address. Use this address to open a browser session to the application and see the result.

⁠Dockerfile

You can view the docker file for the images in my GitHub:

• ltsc2025⁠
• ltsc2022⁠
• ltsc2019⁠