Return
-
Title
Planning for authentication with gMSA -
Description
How to plan for using GMSA with Foglight -
Resolution
If you intend to use gMSA (Group Managed Service Accounts) for authentication, the gMSA infrastructure should be configured prior to Foglight installation. Refer to the Microsoft document Group Managed Service Accounts Overview for information
When authenticating to the external Foglight database using gMSA (Group Managed Service Accounts), take note of the following requirements.- When using gMSA for authentication, you must install Foglight using SQL Server Authentication. Once Foglight is installed, you can configure the appropriate gMSA account for repository authentication
- The gMSA account must have the following accounts mapped on the external SQL repository:
- foglight
- master
- model
- msdb
- tempdb
- When authenticating with gMSA, the Foglight Management Server (FMS) and Foglight Agent Manager (FglAM) must be installed as a service. Once installed, the Log on as account must be updated to the gMSA account.
- The gMSA account requires the -PrincipalsAllowedRetrieveManagedPassword permission. This permission is also required on each service host.
For an account gMSA01 and host ServiceHost, you can grant this permission with the command:
Set-ADServiceAccount gMSA01 -PrincipalsAllowedToRetrieveManagedPassword gMSA01$,ServiceHost01$,ServiceHost02$
Note: The Set-ADServiceAccount command will overwrite the current value of PrincipalsAllowedToRetrieveManagedPassword for the user; to verify the current value run Get-ADServiceAccount -Identity gMSA01 -Properties PrincipalsAllowedToRetrieveManagedPassword - Active Directory module for Windows PowerShell on the host where you want to use the gMSA account is not enabled by default. Please run the following PowerShell command on the host:
PS C:\> Add-WindowsFeature RSAT-AD-PowerShell - The gMSA account must have read and write permissions on the FMS and FglAM installation directories.
- On the machine of the FglAM/FMS, run the following command:
Install-ADServiceAccount -Identity gMSA01 - The gMSA account(s) must be configured with appropriate access, as stated below:
- The FMS gMSA account needs access to:
- SQL Server used for FMS repository if using Windows authentication
- PI SQL Server instances
- The FglAM gMSA account needs access to:
- any SQL Server instances that it monitors
- WMI/WinRM access to any hosts that need to be monitored
- The FMS gMSA account needs access to:
- GMSA accounts typically end in a $, such as FOGLIGHT\DEMOACCOUNT$, similar to computer objects in AD.
- Knowledgebase article 4370132 details how to use the gMSA in the Command Line Installer (CLI) of database agents
- Knowledgebase article 4309105 details how to install a FMS repository using SQL Server with gMSA
- Knowledgebase article 4226284 details how to use gMSA with the SQL PI repository
- When creating a database agent using gMSA, choose the radio button to "Use the Active Directory Account running your agent manager" similar to the following:
- When adding the Operating System Monitoring Extension using a gMSA account to a database agent, choose the radio button to "Log in to the host using different login credentials" with the "Local User" pulldown in the Authentication field. The username should be automatically populated as in the following:
