本地 SF 集群 Kerberos 安全性 (gMSA) 和 ServerCertificate

Question

我们成功创建了不安全且基于证书的集群。我们正在通过使节点到节点的通信使用 gMSA 来试验域安全集群。下面的集群配置 sn-p 显示了有问题的部分：

"security": {
    "ClusterCredentialType": "Windows",
    "ServerCredentialType": "Windows",
    "WindowsIdentities": {
        "ClustergMSAIdentity": "{{ env_domain }}\\{{ cluster_gmsa_identity }}",
        "ClusterSPN": "{{ cluster_gmsa_spn }}",
        "ClientIdentities": [
            {
                "Identity": "{{ env_domain_short }}\\ServiceFabricAdmins",
                "IsAdmin": true
            },
            {
                "Identity": "{{ env_domain_short }}\\ServiceFabricReadOnly",
                "IsAdmin": false
            }
        ]
    },
    "CertificateInformation": {
        "ServerCertificate": {
          "Thumbprint": "{{ primary_server_certificate_thumbprint }}",
          "X509StoreName": "My"
        },
        "ReverseProxyCertificate": {
            "Thumbprint": "{{ primary_server_certificate_thumbprint }}",
            "X509StoreName": "My"
        }
    }            
}

如果我们提供如上所示的 ServerCertificate 属性，则集群创建过程会引发许多异常（其中似乎都不是证书配置问题），如果我删除 ServerCertificate 部分（但保留反向代理提供的证书）集群创建过程是成功的。

我希望那里的 ServerCertificate 保护管理端点的 http 通信通道。需要考虑的几点：

1. ServerCertificate 属性中引用的证书已成功用于我们的证书安全集群。
2. gMSA 对证书存储区中的私钥具有 ACL 读取权限。
3. 运行节点的操作系统是 Windows 2016 1709 (build 16299.334)

为了让集群正确启动并运行，尽管我不得不将 gMSA 帐户放在本地管理员组中（这似乎是错误的！！），如 here 所述。

任何想法将不胜感激？

Answer 1

gmsa 和管理员组

您可以尝试授予一些权限，例如

1. 计算机配置\Windows 设置\安全设置\ 本地策略\用户权限分配\作为服务登录

2. 计算机配置\Windows 设置\安全设置\ 本地策略\用户权限分配\作为批处理作业登录

通过本地策略编辑器。如果您查看这些组，您会看到管理员组已经包含在这些本地组中，而用户组（因为 gmsa 是一个普通帐户）没有。因此，如果您将 gmsa 包含到这些本地组中，该帐户将获得作为服务运行的权限（服务结构看起来像服务本身）

证书配置（登录到门户）+ gmsa（服务器）

{
    "name": "yosfcl",
    "clusterConfigurationVersion": "1.0.1",
    "apiVersion": "10-2017",
    "nodes": [
        {
            "NodeName": "yv1-sf",
            "NodeTypeRef": "NodeType0",
            "IPAddress": "yv1-sf",
            "FaultDomain": "fd:/dc1/r1",
            "UpgradeDomain": "UD1"
        },
        {
            "NodeName": "yv2-sf",
            "NodeTypeRef": "NodeType0",
            "IPAddress": "yv2-sf",
            "FaultDomain": "fd:/dc1/r2",
            "UpgradeDomain": "UD2"
        },
        {
            "NodeName": "yv3-sf",
            "NodeTypeRef": "NodeType0",
            "IPAddress": "yv3-sf",
            "FaultDomain": "fd:/dc1/r3",
            "UpgradeDomain": "UD3"
        }
    ],
    "properties": {
        "diagnosticsStore": 
        {
            "metadata":  "Please replace the diagnostics file share with an actual file share accessible from all cluster machines. For example, \\\\machine1\\DiagnosticsStore.",
            "dataDeletionAgeInDays": "21",
            "storeType": "FileShare",
            "connectionstring": "c:\\ProgramData\\SF\\DiagnosticsStore"
        },      "reverseProxyCertificate": {
            "thumbprint": "[parameters('76************************8A2')]",
            "x509StoreName": "[parameters('My')]"
        },
        "security": {
            "ClusterCredentialType": "Windows",
            "ServerCredentialType": "X509",
            "WindowsIdentities": {
                "ClustergMSAIdentity": "gmsaSF@domain.lan",
                "ClusterSPN": "http/yosfcl.domain.lan",
                "ClientIdentities": [
                    {
                        "Identity": "domain\\my.name",
                        "IsAdmin": true
                    }
                ]
            },
            "CertificateInformation": {
                "ServerCertificate": {
                    "Thumbprint": "76***********************************8A2",
                    "X509StoreName": "My"
                },
                "ReverseProxyCertificate": {
                    "Thumbprint": "76*************************************48A2",
                    "X509StoreName": "My"
                },
                "ClientCertificateThumbprints": [
                    {
                        "CertificateThumbprint": "94***********************************2D",
                        "IsAdmin": true
                    }
                ]
            }
        },
        "nodeTypes": [
            {
                "name": "NodeType0",
                "clientConnectionEndpointPort": "19000",
                "clusterConnectionEndpointPort": "19001",
                "leaseDriverEndpointPort": "19002",
                "serviceConnectionEndpointPort": "19003",
                "httpGatewayEndpointPort": "19080",
                "reverseProxyEndpointPort": "19081",
                "applicationPorts": {
                    "startPort": "20001",
                    "endPort": "20500"
                },
                "ephemeralPorts": {
                    "startPort": "20501",
                    "endPort": "20700"
                },
                "isPrimary": true
            }
        ],

        "fabricSettings": [
            {
                "name": "Setup",
                "parameters": [
                    {
                        "name": "FabricDataRoot",
                        "value": "D:\\SF"
                    },
                    {
                        "name": "FabricLogRoot",
                        "value": "D:\\SF\\Logs"
                    }
                ]
            },          {
                "name": "ApplicationGateway/Http",
                "parameters": [
                    {
                        "name": "SecureOnlyMode",
                        "value": true
                    },
                    {
                        "name": "ApplicationCertificateValidationPolicy",
                        "value": "None"
                    }
                ]
            }
        ]
    } }