Setup a gMSA to be used the Integrated Windows Auth (IWA) feature of Tanzu Application Service (TAS)

bosh-dns.json

[{
  "domain":"activedirectory.tld.address",
  "source":{
    "type":"dns",
    "recursors":["FIRST.IP.OF.ACTIVEDIRECTORY","SECOND.IP.OF.ACTIVEDIRECTORY"]
  }
}]

TAS_IWA_AD_SETUP.md

Create Kds Root key that's active immediately

Add-KdsRootKey -EffectiveTime (Get-Date).AddHours(-10)

Create an AD group to associate gMSA and user to

New-ADGroup -Name "Tas01 Authorized Accounts" -SamAccountName "Tas01Accounts" -GroupScope DomainLocal

Create gMSA

• IMPORTANT: Name should match ServicePrincipalNames: -ServicePrincipalNames "host/$NAME"

New-ADServiceAccount -Name "Tas01" -DnsHostName "Tas01.drb.ad-domain.local" -ServicePrincipalNames "host/Tas01" -PrincipalsAllowedToRetrieveManagedPassword "Tas01Accounts"

Create gMSA user credentials

New-ADUser -Name "TasUser01" -AccountPassword (ConvertTo-SecureString -AsPlainText "Secret123" -Force) -Enabled 1

Add user to gMSA group

Add-ADGroupMember -Identity "Tas01Accounts" -Members "TasUser01"

Save credential spec file

• First time, run: Install-Module CredentialSpec

New-CredentialSpec -AccountName Tas01 -Path "C:\Temp\Tas01_CredSpec.json"

Reference: https://learn.microsoft.com/en-us/virtualization/windowscontainers/manage-containers/manage-serviceaccounts