# Ansible AD Domain Authentication **URL:** \ **Category:** Ansible Project\ **Created:** [April 7, 2016, 12:27pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091 "2016-04-07T12:27:23Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 7, 2016, 12:27pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/1 "2016-04-07T12:27:23Z")
Hi Currently I have been connecting to servers to using local server accounts, and therefore my ‘group\_vars/winservers.yml’ file has looked like the following: ansible\_ssh\_user: Administrator ansible\_ssh\_pass: PASSWORD ansible\_ssh\_port: 5986 ansible\_connection: winrm But now I need to authenticate to servers that are connected on the domain. How would I change this file? Is it as simple as… ansible\_ssh\_user: my.domain\mark.matthews ansible\_ssh\_pass: PASSWORD ansible\_ssh\_port: 5986 ansible\_connection: winrm Cheers ---
**Author:** ![Zacharias\_Thompson](https://avatars.discourse-cdn.com/v4/letter/z/13edae/32.png) [@Zacharias\_Thompson](https://forum.ansible.com/u/Zacharias_Thompson)\ **Post date:** [April 8, 2016, 12:10am UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/2 "2016-04-08T00:10:11Z")
You have to setup a kerberos ticket for the user you want to connect with. After which, if you specify the ansible\_ssh\_user in the format of [user@MY.DOMAIN.COM](mailto:user@MY.DOMAIN.COM), Ansible will attempt to use a kerberos ticket before falling back to basic authentication. See the support site for more details: [http://docs.ansible.com/ansible/intro\_windows.html#configuring-kerberos](http://docs.ansible.com/ansible/intro_windows.html#configuring-kerberos) ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 8, 2016, 11:27am UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/3 "2016-04-08T11:27:16Z")
Hi Zacharias I have setup a kerberos ticket and all seems to be working fine. I am able to do a “knit _username_” and create a ticket. I then add the following entry into /etc/ansible/hosts file [win] [servername.COMPANY.COM](http://servername.COMPANY.COM) I have create the following /etc/ansible/group\_vars/win.yml file with the following information ansible\_ssh\_user: [username@COMPANY.COM](mailto:username@COMPANY.COM) ansible\_ssh\_port: 5986 ansible\_connection: winrm Bu when I try run a playbook to the server in ‘win’ I get the following error: fatal: [uk-ansible-test02.WINTECH.LOCAL]: FAILED! =\> {“failed”: true, “msg”: “ssl: 401 Unauthorized. basic auth failed”} Any ideas as too what could be causing this? Cheers Mark ---
**Author:** ![Mauricio\_Tavares](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Mauricio\_Tavares](https://forum.ansible.com/u/Mauricio_Tavares)\ **Post date:** [April 8, 2016, 12:17pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/4 "2016-04-08T12:17:43Z")
> Hi Zacharias > > I have setup a kerberos ticket and all seems to be working fine. I am able to do a “knit username” and create a ticket. > > I then add the following entry into /etc/ansible/hosts file > [win] > [servername.COMPANY.COM](http://servername.COMPANY.COM) > > I have create the following /etc/ansible/group\_vars/win.yml file with the following information > > ansible\_ssh\_user: [username@COMPANY.COM](mailto:username@COMPANY.COM) > ansible\_ssh\_port: 5986 > ansible\_connection: winrm > > Bu when I try run a playbook to the server in ‘win’ I get the following error: > > fatal: [uk-ansible-test02.WINTECH.LOCAL]: FAILED! =\> {“failed”: true, “msg”: “ssl: 401 Unauthorized. basic auth failed”} > > Any ideas as too what could be causing this? Dumb question: how are you running the playbook? And, what do you get if you crank up the debug? You should see it trying the diff auths. ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 8, 2016, 12:54pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/5 "2016-04-08T12:54:29Z")
Hi Im just running the playbook as follows: ansible-playbook test\_ping.yml The playbook looks like this: - name: Ping Servers hosts: win tasks: - name: ping win\_ping: I run the playbook now with -vvvvv, and got the following output: TASK [setup] \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\* \<[uk-ansible-test02.COMPANY.COM](http://uk-ansible-test02.COMPANY.COM)\> ESTABLISH WINRM CONNECTION FOR USER: [markm\_admin@COMPANY.COM](mailto:markm_admin@COMPANY.COM) on PORT 5986 TO [uk-ansible-test02.COMPANY.COM](http://uk-ansible-test02.COMPANY.COM) \<[uk-ansible-test02.COMPANY.COM](http://uk-ansible-test02.COMPANY.COM)\> WINRM CONNECT: transport=ssl endpoint=[https://uk-ansible-test02.COMPANY.COM:5986/wsman](https://uk-ansible-test02.COMPANY.COM:5986/wsman) \<[uk-ansible-test02.COMPANY.COM](http://uk-ansible-test02.COMPANY.COM)\> WINRM CONNECTION ERROR: 401 Unauthorized. basic auth failed Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py”, line 138, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 125, in send\_message raise UnauthorizedError(transport=‘plaintext’, message=ex.msg) UnauthorizedError: 401 Unauthorized. basic auth failed Its like its making the connection to the server but not authorized to do anything?? If i run the ‘klist’ command to view the token, this is the output: [root@uk-ansible01 windows]# klist Ticket cache: KEYRING:persistent:0:0 Default principal: [user@COMPANY.COM](mailto:user@COMPANY.COM) Valid starting Expires Service principal 08/04/16 13:52:21 08/04/16 23:52:21 krbtgt/COMPANY.COM@COMPANY.COM renew until 08/04/16 23:52:21 ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 8, 2016, 3:13pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/6 "2016-04-08T15:13:41Z")
Hi guys Was doing some digging around and noticed that there were security errors on the test server I was trying to access. Could it be possible that this could be causing the issue: [https://www.winhelp.info/windows/resolve-kerberos-error-0xc000006d-in-windows/](https://www.winhelp.info/windows/resolve-kerberos-error-0xc000006d-in-windows/) As nothing is defined there on my server…so there is nothing checked. Cheers Mark ---
**Author:** ![Zacharias\_Thompson](https://avatars.discourse-cdn.com/v4/letter/z/13edae/32.png) [@Zacharias\_Thompson](https://forum.ansible.com/u/Zacharias_Thompson)\ **Post date:** [April 8, 2016, 5:51pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/7 "2016-04-08T17:51:44Z")
Are you running the kinit under the same user you’re running ansible as? What version of Ansible are you running? ---
**Author:** ![Mauricio\_Tavares](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Mauricio\_Tavares](https://forum.ansible.com/u/Mauricio_Tavares)\ **Post date:** [April 8, 2016, 6:25pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/8 "2016-04-08T18:25:39Z")
I would expect his logs to show ssh trying to do kerberos auth and then failing back to whatever. The fact it is going straight to plain auth is odd. Maybe play around with ansible\_ssh\_common\_args or ansible.cfg to get ssh more verbose? ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [April 9, 2016, 7:49pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/9 "2016-04-09T19:49:20Z")
Hi, My guess would be you haven’t got pykerberos installed. on your ansible controller. If you see transport=ssl in the connection information it isn’t going via kerberos. Since you have a ticket set up I think its just that you don’t have the pykerberos package installed. Hope this helps, Jon ---
**Author:** ![Anjana\_Raghavendra\_P](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Anjana\_Raghavendra\_P](https://forum.ansible.com/u/Anjana_Raghavendra_P)\ **Post date:** [April 10, 2016, 7:08pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/10 "2016-04-10T19:08:43Z")
I am having similar problem and afterwards used the **kerberos** for host variable **ansible\_winrm\_transport.** I am using ansible version 2.0.1.0. The worked configuration: [Win] .XXXX.XXXX.LOCAL [Win:vars] ansible\_user=‘xxx.xxx@XXXX.XXXXX.LOCAL’ ansible\_password= **…** ansible\_port=5986 ansible\_connection=winrm ansible\_winrm\_server\_cert\_validation=ignore #ansible\_winrm\_transport=ssl ansible\_winrm\_transport=kerberos but the problem with this is subsequent runs on this host first throwing following errors and then giving successful result. **/usr/local/lib/python2.7/dist-packages/winrm/transport.py:283: RuntimeError: kerberos.authGSSClientClean is deprecated.** **krb\_ticket.verify\_response(response.headers[‘WWW-Authenticate’])** **.XXXX.XXXX.LOCAL | SUCCESS =\> {** **“changed”: false,** **“ping”: “pong”** **}** If anyone can help that would be better. ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [April 12, 2016, 1:28pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/11 "2016-04-12T13:28:44Z")
Anjana, I have not seen this error before but please advise the following: version of whichever python-kerberos libraries you are using on your ansible controller (see [http://docs.ansible.com/ansible/intro\_windows.html#installing-python-kerberos-dependencies](http://docs.ansible.com/ansible/intro_windows.html#installing-python-kerberos-dependencies)) version of the python kerberos wrapper you are using. version of pywinrm you are using which OS you are running ansible controller on. Many thanks, Jon ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 12, 2016, 4:41pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/12 "2016-04-12T16:41:38Z")
Hi Anjana Where exactly on you putting those varibales [win:var]? Are you putting those variables in /etc/ansible/hosts file? Im still getting the following error: fatal: [[server.COMPANY.COM](http://server.COMPANY.COM)]: FAILED! =\> {“failed”: true, “msg”: “ssl: 401 Unauthorized.”} I have changed my groups\_vars file (/etc/ansible/group\_vars/win.yml) to the following ansible\_user: [user@COMPANY.COM](mailto:user@COMPANY.COM) ansible\_port: 5986 ansible\_connection: winrm ansible\_winrm\_server\_cert\_validation: ignore And the entry on the host file is: [win] [server.COMPANY.COM](http://server.COMPANY.COM) I have double checked that I have a token logged in when I run ‘klist’. No idea what could still be causing this error?? Any ideas would be appreciated. Cheers Mark ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [April 12, 2016, 10:16pm UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/13 "2016-04-12T22:16:52Z")
Hi Mark, If you run a (sudo) pip list on your ansible controller what version is reported for the ‘kerberos’ library? For some reason, ansible is still falling back to using basic auth in your case. When I’ve seen that its either that the connection variables aren’t getting set up, or there is something up with the python kerberos wrapper (such as it being missing). Jon ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 13, 2016, 8:42am UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/14 "2016-04-13T08:42:27Z")
Hi Jon If I do a pip list I get the followining: ansible (2.0.1.0) ansible-tower (2.4.4) Babel (0.9.6) backports.ssl-match-hostname (3.4.0.2) chardet (2.2.1) configobj (4.7.2) decorator (3.4.0) ecdsa (0.13) httplib2 (0.9.2) iniparse (0.4) IPy (0.75) isodate (0.5.4) Jinja2 (2.8) kitchen (1.1.1) langtable (0.0.31) MarkupSafe (0.23) meld3 (0.6.10) mercurial (2.6.2) paramiko (1.16.0) perf (0.1) pip (8.1.1) policycoreutils-default-encoding (0.1) psycopg2 (2.6.1) pyasn1 (0.1.6) pycrypto (2.6.1) pycurl (7.19.0) pygobject (3.14.0) pygpgme (0.3) pyliblzma (0.5.3) python-augeas (0.5.0) python-dmidecode (3.10.13) python-keyczar (0.71rc0) pyudev (0.15) pywinrm (0.1.1) pyxattr (0.5.1) PyYAML (3.11) seobject (0.1) sepolicy (1.1) setuptools (20.6.7) six (1.9.0) slip (0.4.0) slip.dbus (0.4.0) supervisor (3.1.3) urlgrabber (3.10) xmltodict (0.10.1) yum-langpacks (0.4.2) yum-metadata-parser (1.1.4) I then ran through the following directions again: [http://docs.ansible.com/ansible-tower/latest/html/administration/kerberos\_auth.html](http://docs.ansible.com/ansible-tower/latest/html/administration/kerberos_auth.html) ```auto yum install krb5-workstation yum install krb5-devel yum install krb5-libs ``` All three of those said that they were already installed and up to date. But when I ran the following: ```auto pip install kerberos ``` I get the following error: [root@ie-ansible01 group\_vars]# sudo pip install kerberos Collecting kerberos Using cached kerberos-1.2.4.tar.gz Installing collected packages: kerberos Running setup.py install for kerberos … error Complete output from command /usr/bin/python -u -c “import setuptools, tokenize; **file** =‘/tmp/pip-build-bTccYY/kerberos/setup.py’;exec(compile(getattr(tokenize, ‘open’, open)( **file** ).read().replace(‘\r\n’, ‘\n’), **file** , ‘exec’))” install --record /tmp/pip-H50rsj-record/install-record.txt --single-version-externally-managed --compile: running install running build running build\_ext building ‘kerberos’ extension creating build creating build/temp.linux-x86\_64-2.7 creating build/temp.linux-x86\_64-2.7/src gcc -pthread -fno-strict-aliasing -O2 -g -pipe -Wall -Wp,-D\_FORTIFY\_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -D\_GNU\_SOURCE -fPIC -fwrapv -DNDEBUG -O2 -g -pipe -Wall -Wp,-D\_FORTIFY\_SOURCE=2 -fexceptions -fstack-protector-strong --param=ssp-buffer-size=4 -grecord-gcc-switches -m64 -mtune=generic -D\_GNU\_SOURCE -fPIC -fwrapv -fPIC -I/usr/include/python2.7 -c src/base64.c -o build/temp.linux-x86\_64-2.7/src/base64.o unable to execute gcc: No such file or directory error: command ‘gcc’ failed with exit status 1 ---
**Author:** ![Mark\_Matthews](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Mark\_Matthews](https://forum.ansible.com/u/Mark_Matthews)\ **Post date:** [April 13, 2016, 8:57am UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/15 "2016-04-13T08:57:28Z")
I got it working!! I needed to install ‘gcc’. So I ran the following: sudo yum -y install gcc I was then able to run: sudo yum -y install kerberos After that was all installed successfully I was able to run a playbook using AD credentials. Jon - thanks all your help!!! Cheers Mark ---
**Author:** ![Anjana\_Raghavendra\_P](https://avatars.discourse-cdn.com/v4/letter/a/d9b06d/32.png) [@Anjana\_Raghavendra\_P](https://forum.ansible.com/u/Anjana_Raghavendra_P)\ **Post date:** [April 18, 2016, 10:23am UTC](https://forum.ansible.com/t/ansible-ad-domain-authentication/21091/16 "2016-04-18T10:23:26Z")
Hi, Sorry it took so long to respond. I actually followed the same document and installed everything as suggested. As per AMI I am using AWS ubuntu image and python version 2.7.6. my sudo pip list output ansible (2.0.1.0) ansible-tower (2.4.4) apt-xapian-index (0.45) argparse (1.2.1) awscli (1.10.20) boto (2.39.0) boto3 (1.3.0) botocore (1.4.11) chardet (2.0.1) Cheetah (2.4.4) cloud-init (0.7.5) colorama (0.2.5) configobj (4.7.2) docutils (0.12) futures (3.0.5) html5lib (0.999) httplib2 (0.8) isodate (0.5.4) Jinja2 (2.7.2) jmespath (0.9.0) jsonpatch (1.3) jsonpointer (1.0) kerberos (1.2.4) Landscape-Client (14.12) MarkupSafe (0.18) meld3 (0.6.10) mercurial (2.8.2) oauth (1.0.1) PAM (0.4.2) paramiko (1.10.1) passlib (1.5.3) pip (1.5.4) prettytable (0.7.2) psycopg2 (2.4.5) pyasn1 (0.1.9) pycrypto (2.6.1) pycurl (7.19.3) pyOpenSSL (0.13) pyserial (2.6) python-apt (0.9.3.5ubuntu2) python-dateutil (2.5.2) python-debian (0.1.21-nmu2ubuntu2) pywinrm (0.1.1) PyYAML (3.10) requests (2.2.1) rsa (3.3) s3transfer (0.0.1) setuptools (3.3) six (1.5.2) ssh-import-id (3.21) supervisor (3.0b2) Twisted-Core (13.2.0) Twisted-Names (13.2.0) Twisted-Web (13.2.0) urllib3 (1.7.1) wheel (0.24.0) wsgiref (0.1.2) xmltodict (0.10.1) zope.interface (4.0.5) As this is simply a warning, right now I am not taking it as high priority. We are starting new and exploring ansible as of now.