Sharing drives does not work for Azure AD user accounts

[jayfresh]

Hi,

I'm attempting to share my C: drive as per the instructions here - https://docs.docker.com/docker-for-windows/#/shared-drives.

However, it doesn't seem possible to use my login details in the Shared Drives username/password dialog - none of the usernames of the form AzureAD\username, or email@domain or AzureAD\email@domain get through the login.

I've tried setting up a local admin user, "admin", and I can successfully share the drive using that account, but according to the troubleshooting, https://docs.docker.com/docker-for-windows/troubleshoot/#verify-domain-user-has-permissions-for-shared-drives-volumes, you have to run the docker commands using the same user as you have used to share the drive.

The same troubleshooting mentions that the solution is to login with a domain user, which in my case I assume is the AzureAD user, but as I mentioned, Docker is not accepting the credentials.

Information

Diagnostic ID: B84C9FF9-58D6-4C1D-8BBA-D94E145DE072/2016-10-06_10-14-53

This is on Windows 10, version 1607, OS Build 14393.222.

Steps to reproduce the behavior

1. Login using Azure AD user account
2. Install Docker as normal
3. Try to share a drive using the Azure AD user account
4. Credentials popup reappears, not accepting credentials

[simonferquel]

When the popup appears, what is the value prefilled for user name ?
Can you try not to change it and give your Azure AD password ?

[jayfresh]

Hi Simon, there isn't any value prefilled for user name. And if I fill in a user name and password, the popup reappears without any value prefilled - see screenshot.

I'm using the latest stable build, v1.12.1 I think (from docker --version)

[jayfresh]

I've downloaded the beta version and it's a bit different - there is a prefilled user name, but when I put my password in, the popup disappears and the C drive checkbox goes back to being unchecked. I'm just checking the log...

[simonferquel]

Ok, we might have to setup a lab to further test AzureAD related scenarios.
I'll track the issue in our internal repo, in the mean time, having a local account with correct NTFS rights is a perfectly suitable workaround

[jayfresh]

the problem with using a local account to share the drive is that you hit the problem mentioned in the troubleshooting - you can't be logged in as your AzureAD account and run docker commands, as that's not the same user account as you used to share the C drive...

[jayfresh]

Here's the diagnostic ID running this on the beta version: B84C9FF9-58D6-4C1D-8BBA-D94E145DE072/2016-10-06_12-23-37

[jayfresh]

In the log, got the error System error 1332 has occurred. No mapping between account names and security IDs was done.

[simonferquel]

With the beta you should be able to:

• Log on with the AzureAD account
• Create a local account (without login in)
• Put correct ntfs rights for the local account
• Launch Docker For Windows from the Azure AD account session, and when sharing the drive, specifiy the local account and password

What you can't do is switch from different user account sessions and run docker commands (all docker commands must be done from the same session, but the account used for drive sharing can be different)

[jayfresh]

Thanks! Two queries though - the popup credentials won't let me change the username to use the local admin account, it just says it's an invalid login/password when I submit it. Secondly, I don't know what you mean about the correct ntfs rights for the local account, could you explain? Thanks again.

[simonferquel]

as a username just put your username without the AzureAD prefix (and make sure the account password is not expired)

The thing about NTFS rights is that you have to make sure the local user has the rights to read and/or write in the folder you want to mount as a volume in a container

[jayfresh]

OK, that works! Great, thanks for the support. I'll look out for updates where it stops being necessary to use a local admin account

[jayfresh]

Sadly, I spoke too soon. Whilst I can run a command like docker run --rm -v c:/Users:/data <image> ls /data, I can't run a command like docker run --rm -v c:/Users/<Azure account>:/data <image> ls /data - I get a Permission denied error. However, I can run docker run --rm -v c:/Users/<admin account>:/data <image> ls /data.

I verified I can't access other account folders in c:/Users. I've checked the folder permissions for the Azure account folder and it says that the Administrators group has full control, so I don't understand why docker can't access the folder.

[simonferquel]

Try to add read access directly to your local user on the folder you want to mount. I think that for security reasons, rights on the administrators group are ignored if you are not in an elevated context (which is not possible remotely)