Running the Apache Kerby KDC in docker

Apache Kerby is a subproject of the Apache Directory project, and is a complete open-source KDC written entirely in Java. Apache Kerby 1.1.1 has been released recently. Last year I wrote a blog post about how to configure and launch Apache Kerby, by first obtaining the source distribution and building it using Apache Maven. In this post we will cover an alternative approach, which is to download and run a docker image I have prepared which is based on Apache Kerby 1.1.1.

The project is available on github here and the resulting docker image is available here. Note that this is not an official docker image - and so it provided just for testing or experimentation purposes. First clone the github repository and either build the image from scratch or download it from dockerhub:

• docker build . -t coheigea/kerby

 or:

• docker pull coheigea/kerby

The docker image builds a KDC based on Apache Kerby and runs it when started. However, it expects a directory to be supplied as the first argument (defaults to '/kerby-data/conf') containing the configuration files for Kerby. The github repository contains the relevant files in the 'kerby-data' directory. As well as the configuration files, it stores the admin keytab and a JSON file containing the default principals for the KDC.

Start the KDC by mapping the kerby-data directory to a volume on the container:

• docker run -it -p 4000:88 -v `pwd`/kerby-data:/kerby-data coheigea/kerby

Now we can log into the docker image and create a user for our tests:

• docker exec -it <id> bash
• stty rows 24 columns 80 (required to run jline in docker)
• sh bin/kadmin.sh /kerby-data/conf/ -k /kerby-data/keytabs/admin.keytab
• Then: addprinc -pw password alice@EXAMPLE.COM

To test the KDC from outside the container you can use the MIT kinit tool. Set the KRB5_CONFIG environment variable to point to the "krb5.conf" file included in the github repository, e.g:

• export KRB5_CONFIG=`pwd`/krb5.conf
• kinit alice

This will get you a ticket for "alice", that can be inspected via "klist".