Running ProGet with Group Managed Service Account

mhelp_5176

Hi,

I'm currently running ProGet 2024.0.26. I'm using the integrated web server and have a regular service account configured to run the INEDOPROGETSVC service and INEDOPROGETWEBSVC web server Windows services. I have a database user ID and password configured in the connection string.

This works great, but I'd like to switch to use a Windows group managed service account (gMSA). I'm able to use a gMSA as the account in the INEDOPROGETSVC service and INEDOPROGETWEBSVC web server Windows services. However, if I change the connection string to use "Integrated Security=true;", "Integrated Security=SSPI;", or "Trusted_Connection=true" and restart the Windows services, the services start, but the website doesn't load. When I open Inedo Hub, ProGet has a "View Error" button that has the following message:

"Product: ProGet
Version: 24.0.26

The Inedo Hub is unable to connect to the "MyDatabase" database: Login failed for user '<Domain>\MyLoggedInUser'.

The above username is the account you're currently logged-in to Windows with.
Please ask your database administrator to grant db_owner access to the above username.
Or, try logging-in to Windows with a different account."

I have granted "db_owner" and "ProGetUser_Role" to the group managed service account, but for whatever reason it appears it's attempting to connect using the user account I'm using to logon to the server. The group managed service account has been added to the "Logon as a service" policy. I also added it to the Administrators group in case that made a difference even though it didn't appear to be needed when I was using my regular service account.

I have used a group managed service account as the application pool identity for years in IIS, but I'm not using IIS since it's not really recommended according to the Inedo documentation. I tried to track down any guidance on using a group managed service account, including the "inedo-docs" GitHub repository, but it seems like I'm still missing something.

Any help is very much appreciated.

Thanks!

stevedennis

Hi @mhelp_5176 ,

When upgrading ProGet 2024 and earlier via the Inedo Hub, the user performing the upgrade must have db_owner permission. So, this behavior is expected if <Domain>\MyLoggedInUser doesn't have access.

I'm not sure if you can log in to Windows using a gMSA or not. But, the easiest move is just to give <Domain>\MyLoggedInUser the appropriate access, or just switch to username/password authentication.

In ProGet 2025 and later, the ProGet application itself performs the upgrade, so that user account would need db_owner permission.

Thanks,
Steve

mhelp_5176

Hi Steve,

I'm not upgrading...I'm just trying to change the connection string in Inedo Hub in a way that it will use the group managed service account. When I do that, using integrated security or trusted_connection, it seems to be trying to use my logged on user.

Is the only way I'm going to be able to do that is if I run it through IIS instead of the integrated web server?

I cannot logon to the server with the group managed service account. The group managed service account has permissions on the server and in the database.

Thanks!

rhessinger

Hi @mhelp_5176,

When hosting via the Integrated Web Server, you will need to update the account the service is running as. As long as the GMSA is a db_owner on your database, then "Integrated Security=true;" in your connection string will use that account. As for installs through the InedoHub with "Integrated Security=true;" , it will use the account of the person running InedoHub when connecting to SQL Server during the install, so that account will need DBO on the ProGet database as well.

Thanks,
Rich

sgardj_2482

I was trying to do the same thing. These are the steps I took to get it working. Some of the steps I gave examples for both a standard service account and a group managed service account to help show how to do it either way. The PostgreSQL references to the group managed service account can be swapped for the service account if a standard service account is the preference.

File Permissions

Change only the 'ProGetService' logon_as to service account.
Note: If using a Group Managed Service Account, leave the password fields blank

Grant 'Full Control' permissions over each directory configured in Advanced settings for the following settings:

Extensions.BuiltInExtensionsPath
Extensions.CommonCachePath
Extensions.ExtensionsPath
Storage.PackagesRootPath
Storage.LocalStoragePath

Certificate Key Permissions

Navigate to the certificate used by the server for SSL encryption:

Start > Run > MMC
File > Add/Remove Snap-in...
Add 'Certificates' for "Computer Account"
In the Personal certificates store, right-click the appropriate certificate, select "All Tasks > Manage Private Keys..."
Add the service account and grant it 'Read' permissions

HTTPS Binding to a Hostname

Edit C:\ProgramData\Inedo\SharedConfig\ProGet.config
Update 'WebServer' Urls element to use "https://*:443".

Note: Using the hostname instead of the wildcard will cause all feeds and assets to use Windows Integrated Authentication making any attempt to authenticate with an API key fail.

Run the following from an elevated administrator privilege console:

(Service Account)
netsh http add urlacl url=https://*:443/ user=svcServiceAccount

<or>

(Group Managed Service Account)
netsh http add urlacl url=https://*:443/ user=DOMAIN\gmsaServiceAccount$

Execute the command:
netsh http add sslcert hostnameport=myproget.com:443 certhash=<thumbprint> certstorename=My appid="{E7FD8489-4931-45D9-8D42-427367B12584}"

Run as a user with domain administrator privileges:

(Service Account)
setspn -U -S HTTP/server.fqdn.com svcServiceAccount

<or>
(Group Managed Service Account)
setspn -S HTTP/server.fqdn.com gmsaServiceAccount

PostgreSQL SSPI Authentication

Edit C:\ProgramData\Inedo\SharedConfig\ProGet.config

Note: Save the password from the database connection string as it will be needed to connect to the database later

Update the connection string to delete the 'Password' attribute and value, change the username to 'Username=gmsaServiceAccount$@DOMAIN"

Note: The user name must end with the '$' character if it is a group managed service account. Also the name is case sensitive.

Edit C:\ProgramData\ProGet\Database\pg_hba.conf
Add the following line:
host all gmsaServiceAccount$@DOMAIN 127.0.0.1/32 sspi

PostgreSQL Login/Group Roles

Execute the command:
"C:\Program Files\ProGet\Service\postgres\bin\psql.exe" -d proget -U proget -h 127.0.0.1 -p 5728 -c "CREATE ROLE ""gmsaServiceAccount$@DOMAIN"" WITH LOGIN SUPERUSER INHERIT CREATEDB CREATEROLE REPLICATION BYPASSRLS;"

When prompted, enter the password that was saved from the database connection string in C:\ProgramData\Inedo\SharedConfig\ProGet.config

<or>

You can create a SQL script file named C:\Temp\init_roles.sql and add the following:

-- Role: "gmsaServiceAccount$@DOMAIN"
-- DROP ROLE IF EXISTS "gmsaServiceAccount$@DOMAIN";

CREATE ROLE "gmsaServiceAccount$@DOMAIN" WITH
  LOGIN
  SUPERUSER
  INHERIT
  CREATEDB
  CREATEROLE
  REPLICATION
  BYPASSRLS;

Execute the script:
"C:\Program Files\ProGet\Service\postgres\bin\psql.exe" -d proget -U proget -h 127.0.0.1 -p 5728 -f C:\Temp\init_roles.sql

Alternatively, you can install pgAdmin (https://www.pgadmin.org/download/pgadmin-4-windows/) and add the role by navigating down the Object Explorer, right-clicking on 'Log/Group Roles > Create > Login/Group Role...'

Give the name in the format "gmsaServiceAccount$@DOMAIN", and on the Privileges tab enable all privileges, then Save.

stevedennis

Thanks for sharing all the details @sgardj_2482.

You shouldn't need to modify the Embedded Database like this when using a GMSA. It should continue to work just fine using a username/password as configured. If you ran into an issue when changing the service account, please let us know.

Note that we don't support modifying the Embedded Database like this, so please be aware this may suddenly break in a future upgrade.