# AAP WinRM Kerberos without SPN **URL:** \ **Category:** Get Help\ **Tags:** windows, aap\ **Created:** [January 14, 2026, 1:57pm UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104 "2026-01-14T13:57:26Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![blockedprocess](https://avatars.discourse-cdn.com/v4/letter/b/a88e57/32.png) [@blockedprocess](https://forum.ansible.com/u/blockedprocess)\ **Post date:** [January 14, 2026, 1:57pm UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104/1 "2026-01-14T13:57:26Z")
I’m using an operator install of Ansible Automation Platform 2.5 on OpenShift. We have multi-homed WIndows servers I want to connect to with WinRM and the interfaces are handled with different FQDNs. I am authenticating for WinRM via Kerberos, but the FQDN I need to connect to isn’t a HOST SPN. A ping template successfully connects to the server if I use an SPN that exists as a HOST entry. For example: setspn -L myhost HOST/myhost HOST/myhost.interface1.domain.local TERMSRV/myhost.interface2.domain.local Connection works fine if I use myhost.interface1.domain.local as my FQDN in my inventory. How can I tell ansible with Kerberos to connect using myhost.interface2.domain.local? ---
**Author:** ![trippinnik](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/trippinnik/32/4308_2.png) [@trippinnik](https://forum.ansible.com/u/trippinnik)\ **Post date:** [January 22, 2026, 8:00pm UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104/2 "2026-01-22T20:00:24Z")
Have you tried creating the SPN and using that FQDN? ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [January 22, 2026, 9:44pm UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104/3 "2026-01-22T21:44:10Z")
If you are using the [winrm connection plugin](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/winrm_connection.html) you can set the variable `ansible_winrm_kerberos_hostname_override` to override the hostname portion of the SPN used with Kerberos auth. The [psrp connection plugin](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/psrp_connection.html) uses the variable `ansible_psrp_negotiate_hostname_override`. Otherwise you can also do as suggested and manually add the SPNs for the hostname you are connecting with. ---
**Author:** ![blockedprocess](https://avatars.discourse-cdn.com/v4/letter/b/a88e57/32.png) [@blockedprocess](https://forum.ansible.com/u/blockedprocess)\ **Post date:** [January 23, 2026, 4:12pm UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104/4 "2026-01-23T16:12:26Z")
I am testing this. It appears this is what I’ll need to do. Ansible docs say HTTP is the default service class. I wonder why it’s not defaulting to WSMAN. ---
**Author:** ![blockedprocess](https://avatars.discourse-cdn.com/v4/letter/b/a88e57/32.png) [@blockedprocess](https://forum.ansible.com/u/blockedprocess)\ **Post date:** [January 23, 2026, 4:34pm UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104/5 "2026-01-23T16:34:04Z")
I’m using groups of hosts in my inventory and specifying the Kerberos variables there. We don’t have appropriate SPNs already existing in our domain that would make this feasible. If I have to add SPNs anyway, I’m thinking I might as well just create the correct ones and specify the correct FQDNs in my inventory. Great idea though. I wasn’t aware of these options. I’m curious how this might work though. Assuming I have SPN HTTP/myhost.interface1.domain.local (I’m seeing in docs that Ansible defaults to HTTP Kerberos service class for WinRM) …per host in inventory as so (with proper indentation, of course)? > windows\_servers: > hosts: > myhost.interface2.domain.local ansible\_winrm\_kerberos\_hostname\_override=myhost.interface1.domain.local ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [January 24, 2026, 1:54am UTC](https://forum.ansible.com/t/aap-winrm-kerberos-without-spn/45104/6 "2026-01-24T01:54:34Z")
> [@blockedprocess](#): > > Ansible docs say HTTP is the default service class. I wonder why it’s not defaulting to WSMAN. I need to update the docs but the winrm connection plugin defaults to `HTTP` while the psrp connection plugin right now defaults to `WSMAN`. I actually have a new release of the underlying `psrp` library to change the default from `HTTP` to `host` but that isn’t live yet. The reason why `WSMAN` isn’t used is because not even the WinRM client on Windows uses `WSMAN` for Kerberos auth. Doing `Invoke-Command -ComputerName foo { ... }` actually uses the `host` SPN and this is why I’m changing the psrp libraries defaults as well. The `WSMAN` service is only used with CredSSP authentication for some unknown reason and it’s not always registered to hosts so it’s not 100% reliable. The key thing here is that the server you are talking to must have the SPN registered on it. This is the server identification security feature that is part of Kerberos. If the computer principal in AD doesn’t have the SPN registered or the SPN is registered to another principal then the WinRM service will fail to prove its identity breaking the authentication side.