Azure Service Fabric - Windows security using gMSA - Details

On your Domain Controller:

Check if you already have a Kds Key:

Get-KdsRootKey

If not run the next line:

Add-KdsRootKey -EffectiveTime ((get-date).addhours(-10))

Validate it was created:

Get-KdsRootKey

Create the gMSA: (where its name in this sample is gMSA-SF-1, and it has 4 machines SF1,SF2,SF3,SF4)

New-ADServiceAccount -Name gMSA-SF-1 -DNSHostName gMSA-SF-1.myDomain.local -PrincipalsAllowedToRetrieveManagedPassword SF1$,SF2$,SF3$,SF4$ -ServicePrincipalNames ServiceFabric/gMSA-SF-1.myDomain.local

If later on, you need to add/remove nodes:

Set-ADServiceAccount -Identity gMSA-SF-1 -PrincipalsAllowedToRetrieveManagedPassword SF1$, SF2$, SF3$, SF4$, SF5$

Don't forget to create a Domain group with all users that should get Admin rights on the cluster using the UI - in the example below the name of this group is "SFAdmins"

On each of the cluster machines (before deploying the Service Fabric Cluster):

Add the Powershell support to manage AD:

Add-WindowsFeature RSAT-AD-PowerShell

Install the gMSA:

Install-AdServiceAccount gMSA-SF-1

Configuring the Security section:

"security": {

            "ServerCredentialType": "Windows",

            "WindowsIdentities": {

                "ClustergMSAIdentity": "mydomain.local\\gMSA-SF-1",

                "ClusterSPN": "ServiceFabric/gMSA-SF-1.mydomain.local",

                "ClientIdentities": [

                    {

                        "Identity": "mydomain.local\\SFAdmins",

                        "IsAdmin": true

                    }

                ]

            }

        },