title: How can I get Kerberos authentication to work in a Docker Linux container hosting a .Net 6 application with a SqlConnnection?
body: <p>I am experimenting in a small lab created with AutomatedLab that contains Windows Server 2022 machines running ActiveDirectory and SQLServer along with CentOS 8.5 machines running a Kubernetes cluster. My test application is a .Net 6 console application that simply connect to a SQLServer database running in the the lab over a trusted connection. It is containerized based on the official aspnet:6.0 image. The Kubernetes POD contains an InitContainer that executes kinit to generate a Kerberos token placed in a shared volume. I have made two versions of the test application: one that uses an OdbcConnection to connect to the database and the second one uses a SqlConnection. The version with the OdbcConnection successfully connects to the database but the one using the SqlConnection crashes when opening the connection to the database.</p>
  <p>Here is the code of the application using the OdbcConnection:</p>
  <pre><code>using (var connection =
                 new OdbcConnection(
                     &quot;Driver={ODBC Driver 17 for SQL Server};Server=sql1.contoso.com,1433;Database=KubeDemo;Trusted_Connection=Yes;&quot;))
          {
              Log.Information(&quot;connection created&quot;);
              var command = new OdbcCommand
                  (&quot;select * from KubeDemo.dbo.Test&quot;, connection);
              connection.Open();
              Log.Information(&quot;Connection opened&quot;);
              using (var reader = command.ExecuteReader())
              {
                  Log.Information(&quot;Read&quot;);
                  while (reader.Read())
                  {
                      Console.WriteLine($&quot;{reader[0]}&quot;);
                  }
              }
          }
  </code></pre>
  <p>The logs of the container show that it can connect to the database and read its content</p>
  <pre><code>[16:24:35 INF] Starting the application
  [16:24:35 INF] connection created
  [16:24:35 INF] Connection opened
  [16:24:35 INF] Read
  1
  </code></pre>
  <p>Here is the code of the application using the SqlConnection:</p>
  <pre><code>using (var connection =
                 new SqlConnection(
                     &quot;Server=sql1.contoso.com,1433;Initial Catalog=KubeDemo;Integrated Security=True;&quot;))
          {
              Log.Information(&quot;connection created&quot;);
              var command = new SqlCommand
                  (&quot;select * from KubeDemo.dbo.Test&quot;, connection);
              connection.Open();
              Log.Information(&quot;Connection opened&quot;);
              using (var reader = command.ExecuteReader())
              {
                  Log.Information(&quot;Read&quot;);
                  while (reader.Read())
                  {
                      Console.WriteLine($&quot;{reader[0]}&quot;);
                  }
              }
          }
  </code></pre>
  <p>The container crashes, based on the log when the connection is being opened:</p>
  <pre><code>[16:29:58 INF] Starting the application
  [16:29:58 INF] connection created
  </code></pre>
  <p>I have deployed the Kubernetes pod with a command &quot;tail -f /dev/null&quot; so that I could execute the application manually and I get an extra line:</p>
  <pre><code>[16:29:58 INF] Starting the application
  [16:29:58 INF] connection created
  Segmentation fault (core dumped)
  </code></pre>
  <p>According to Google, this is C++ error message that indicates an attempt to access an unauthorized memory section. Unfortunately I have no idea how to work around that. Does anyone has an idea how to get it to work?</p>
  <p>To be complete, here is the Dockerfile for the containerized application</p>
  <pre><code>FROM mcr.microsoft.com/dotnet/aspnet:6.0 
  
  ARG DEBIAN_FRONTEND=noninteractive
  RUN apt-get update
  RUN apt-get install curl gnupg2 -y
  RUN curl https://packages.microsoft.com/keys/microsoft.asc | apt-key add -
  RUN curl https://packages.microsoft.com/config/debian/11/prod.list &gt; /etc/apt/sources.list.d/mssql-release.list
  RUN apt-get update
  RUN ACCEPT_EULA=Y apt-get install --assume-yes --no-install-recommends --allow-unauthenticated unixodbc msodbcsql17 mssql-tools
  RUN apt-get remove curl gnupg2 -y
  RUN echo 'export PATH=&quot;$PATH:/opt/mssql-tools/bin&quot;' &gt;&gt; ~/.bash_profile 
  RUN echo 'export PATH=&quot;$PATH:/opt/mssql-tools/bin&quot;' &gt;&gt; ~/.bashrc
  
  WORKDIR /app
  EXPOSE 80
  COPY ./ .
  ENTRYPOINT [&quot;dotnet&quot;, &quot;DbTest.dll&quot;]
  </code></pre>
  <p>And the POD Helm template:</p>
  <pre><code>apiVersion: v1
  kind: Pod
  metadata:
    name: dbtest
    labels:
      app: test
  spec:    
    restartPolicy: Never
    volumes:
      - name: kbr5-cache
        emptyDir:
          medium: Memory
      - name: keytab-dir
        secret:
          secretName: back01-keytab
          defaultMode: 0444
      - name: krb5-conf
        configMap:
          name: krb5-conf
          defaultMode: 0444
    initContainers:
      - name: kerberos-init
        image: gambyseb/private:kerberos-init-0.2.0
        imagePullPolicy: {{ .Values.image.pullPolicy }}
        securityContext:
          allowPrivilegeEscalation: false
          privileged: false
          readOnlyRootFilesystem: true
        env:
          - name: KRB5_CONFIG
            value: /krb5
        volumeMounts:
          - name: kbr5-cache
            mountPath: /dev/shm
          - name: keytab-dir
            mountPath: /keytab
          - name: krb5-conf
            mountPath: /krb5
    containers:
      - name: dbtest
        image: {{ .Values.image.repository }}:DbTest-{{ .Chart.AppVersion }}
        imagePullPolicy: {{ .Values.image.pullPolicy }}          
        env:
          - name: ASPNETCORE_ENVIRONMENT
            value: &quot;{{ .Values.environment.ASPNETCORE }}&quot;
          - name: KRB5_CONFIG
            value: /krb5
  {{/*      command:*/}}
  {{/*        - &quot;tail&quot;*/}}
  {{/*        - &quot;-f&quot;*/}}
  {{/*        - &quot;/dev/null&quot;*/}}
        securityContext:
          allowPrivilegeEscalation: true
          privileged: true
        ports:
          - containerPort: 80
        volumeMounts:
          - name: kbr5-cache
            mountPath: /dev/shm
          - name: krb5-conf
            mountPath: /krb5
          - name: keytab-dir
            mountPath: /keytab
  {{/*    - name: kerberos-refresh*/}}
  {{/*      image: gambyseb/private:kerberos-refresh-0.1.0*/}}
  {{/*      imagePullPolicy: {{ .Values.image.pullPolicy }}*/}}
  {{/*      env:*/}}
  {{/*        - name: KRB5_CONFIG*/}}
  {{/*          value: /krb5*/}}
  {{/*      volumeMounts:*/}}
  {{/*        - name: kbr5-cache*/}}
  {{/*          mountPath: /dev/shm*/}}
  {{/*        - name: keytab-dir*/}}
  {{/*          mountPath: /keytab*/}}
  {{/*        - name: krb5-conf*/}}
  {{/*          mountPath: /krb5*/}}
    imagePullSecrets:
      - name: {{ .Values.image.pullSecret }}
  </code></pre>