Chapter 7. Deploying SSSD Containers With Different Configurations

As a system administrator, you can deploy multiple unprivileged SSSD containers that each use a specific identity provider, such as Identity Management or Active Directory. This enables other application containers to use only their preferred identity source.

7.1. Prerequisites

  • To use the services provided by the SSSD container from other containers, the client container’s rhel7 base image must include the sssd-client package. However, the default rhel7 base image does not include this package.

    If you need to use the SSSD services from other containers, create your own image for the client container based on the default rhel7 base image and include sssd-client. For details, see Creating Docker images.

7.2. Starting the SSSD Container and Joining It to an Identity Resource

To start an SSSD container and join it to an identity resource, such as Active Directory:

  1. Start the SSSD container by using the atomic install command. For example:

    # atomic install --opt1='--dns=192.0.2.1 --dns-search=idm.example.com --hostname=server.ad.example.com -e SSSD_CONTAINER_TYPE=application --net=default' --name=ad_sssd rhel7/sssd realm join -v ad.example.com

    The previous example creates an SSSD application container named ad_sssd. Pass the DNS server IP address, search domain, host name, and realm join command to atomic install to automatically join SSSD running in the container to the Active Directory domain.

    Repeat this step for each identity provider for which you want to provide an SSSD container.

  2. Start the container. For example:

    # atomic run ad_sssd

7.3. Passing the SSSD Cache to an Application Container

To use the SSSD cache in an application container, pass the relevant directories to the docker run command when you start the application container:

# docker run --rm --name=<container_name> -v=/var/lib/sssd_container/<sssd-container-name>/client/etc/krb5.conf.d:/etc/krb5.conf.d -v=/var/lib/sssd_container/<sssd-container-name>/client/var/lib/sss/pipes/:/var/lib/sss/pipes/ <image_name>

This maps the directories of the SSSD container to the corresponding directory inside the application container.

The application running in the container is now able to authenticate using, for example, the kinit utility or the mod_auth_gssapi module.