I have setup an IIS inside a container and I can use the host's IIS to connect to that "server".

Next step, I need to host a web application inside (I have successfully done it if the web is not related to AD)

The case is, our web applications need to be authenicated using our ad accounts and now, if I start the web inside the container, even I type the correct account + pw, it still gives me

401 - Unauthorized: Access is denied due to invalid credentials.

So... how to use AD inside a container?

As told by https://blogs.msdn.microsoft.com/containerstuff/2017/01/30/create-a-container-with-active-directory-support/

I have came across gMSA

  1. I logged in to the AD server and run:

    New-ADServiceAccount -Name ABC -PrincipalsAllowedToRetrieveManagedPassword ABC-Servers –DNSHostName ABC.domain.com
  2. I went to the server with Docker installed and run:

    Import-Module ./CredentialSpec.psm1
    New-CredentialSpec -Name ABC -AccountName ABC
  3. start a new container with




But in the end, it still requires me to authenticate my-self and no matter what I typed, all 401...

btw, nltest /parentdomain shows me the ad server name


I have solved it. I have missed the setspn and -h part

Part of this solution is related to these links: https://blogs.msdn.microsoft.com/containerstuff/2017/07/31/getting-iis-win-auth-to-work-in-a-container/


The hostname of the host machine = abcHost (confirm by running hostname in cmd)

To have it done, firstly, as I mentioned: 1. Log in to the AD server and run:

New-ADServiceAccount -Name accountABC -PrincipalsAllowedToRetrieveManagedPassword ABC-Servers –DNSHostName abcHost.domain.com
  1. Go to the server with Docker installed (host machine) and run: Import-Module ./CredentialSpec.psm1 New-CredentialSpec -Name accountABC -AccountName accountABC

So, we now have a service account : ABC And the next step is to link the machine name with the service account, therefore run setspn in the ad server:

setspn -c -s HTTP/abcHost domian\accountABC

Afterthat, to have the container run with the service account, we need to add -h option in Docker run. together with the gMSA account created before, the command will be:

Docker run -it --name accountABC -h accountABC -v <a directory> --security-opt "credentialspec=file://accountABC.json" myImage

Then, for IIS application, that select that "server or container" in "Connections" Panel > Feature Delegration > set all "Authentication - SOMETHING" to Read/Write

Then it is done

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.