Chapter 7. Deploying SSSD Containers With Different Configurations
As a system administrator, you can deploy multiple unprivileged SSSD containers that each use a specific identity provider, such as Identity Management or Active Directory. This enables other application containers to use only their preferred identity source.
7.1. Prerequisites
To use the services provided by the SSSD container from other containers, the client container’s rhel7 base image must include the
sssd-clientpackage. However, the default rhel7 base image does not include this package.If you need to use the SSSD services from other containers, create your own image for the client container based on the default rhel7 base image and include
sssd-client. For details, see Creating Docker images.
7.2. Starting the SSSD Container and Joining It to an Identity Resource
To start an SSSD container and join it to an identity resource, such as Active Directory:
Start the SSSD container by using the
atomic installcommand. For example:# atomic install --opt1='--dns=192.0.2.1 --dns-search=idm.example.com --hostname=server.ad.example.com -e SSSD_CONTAINER_TYPE=application --net=default' --name=ad_sssd rhel7/sssd realm join -v ad.example.comThe previous example creates an SSSD application container named
ad_sssd. Pass the DNS server IP address, search domain, host name, andrealm joincommand toatomic installto automatically join SSSD running in the container to the Active Directory domain.Repeat this step for each identity provider for which you want to provide an SSSD container.
Start the container. For example:
# atomic run ad_sssd
7.3. Passing the SSSD Cache to an Application Container
To use the SSSD cache in an application container, pass the relevant directories to the docker run command when you start the application container:
# docker run --rm --name=<container_name> -v=/var/lib/sssd_container/<sssd-container-name>/client/etc/krb5.conf.d:/etc/krb5.conf.d -v=/var/lib/sssd_container/<sssd-container-name>/client/var/lib/sss/pipes/:/var/lib/sss/pipes/ <image_name>This maps the directories of the SSSD container to the corresponding directory inside the application container.
The application running in the container is now able to authenticate using, for example, the kinit utility or the mod_auth_gssapi module.
