# Ansible V2.7 - kerberos: authGSSClientStep() failed:

**URL:** <https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906>\
**Category:** Ansible Project\
**Tags:** windows, gcp\
**Created:** [July 30, 2019, 3:54pm UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906 "2019-07-30T15:54:03Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sushena\_Parthasarath](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@Sushena\_Parthasarath](https://forum.ansible.com/u/Sushena_Parthasarath)\
**Post date:** [July 30, 2019, 3:54pm UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/1 "2019-07-30T15:54:03Z")

</div>

Hi Team,  
we`re using Ansible v 2.7, below python modules for kerberos. We have switched from basic to kerberos auth all playbooks are failing with below error

**Python (Kerberos) modules:**  
kerberos 1.3.0  
requests-kerberos 0.12.0

**Ansible host file:**  
ansible\_user= Ansibleservice@NORTHIND.INTERNAL  
ansible\_password= ‘2\*S\<5q$Vn#]M’  
ansible\_connection= winrm  
ansible\_winrm\_transport= kerberos  
#ansible\_winrm\_realm= NORTHIND.INTERNAL  
ansible\_winrm\_scheme= http  
ansible\_winrm\_server\_cert\_validation= ignore  
ansible\_port= 5985  
ansible\_winrm\_kerberos\_delegation= yes

kinit command succeeds and able to do klist as well. But when we execute win\_ping module to the Windows(2012) node which is part of domain (NORTHIND.INTERNAL), failing with below error. Can anyone assists to fix this below error?

**Command:** _ansible -i /home/ansible/hosts win -m win\_ping -e=“ansible\_ssh\_port=5985, ansible\_connection=winrm”_

**Error:**

_gcp-bashost.NORTHIND.INTERNAL | UNREACHABLE! =\> {_  
_“changed”: false,_  
_“msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”,_  
_“unreachable”: true_  
_}_

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [July 30, 2019, 11:03pm UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/2 "2019-07-30T23:03:02Z")

</div>

Part of the Kerberos authentication process is to lookup the remote server in the KDC database (AD database). If it cannot find that server then you will get this error. In this case it will lookup the host using the SPN ‘HTTP/gcp-bashost.NORTHIND.INTERNAL’ . If you have defined ansible\_host for that host then it will be using that hostname as the 2nd part of the SPN.

The fact that you can use kinit to get the credentials shows that your Ansible controller is talking to the domain correctly, this issue is around not being able to lookup your remote host. Make sure;

- You are connecting to the host using the FQDN and not an IP address
- The remote host is part of the domain
- If you need to connect with an IP, you can use ‘ansible\_winrm\_kerberos\_hostname\_override’ to set the host’s FQDN so the SPN lookup works

Also you should change your password right now and never share it in a public setting again.

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![Sushena\_Parthasarath](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@Sushena\_Parthasarath](https://forum.ansible.com/u/Sushena_Parthasarath)\
**Post date:** [October 11, 2019, 9:08am UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/3 "2019-10-11T09:08:39Z")

</div>

Hi Jordan,  
I have tried all the possibilities and your suggestions as well still the same error for windows alone. Is there any work around for this?

**N.B:** I have modified the password before posting it.

---

<div class="post-metadata">

**Author:** ![Piyush\_Bansal](https://avatars.discourse-cdn.com/v4/letter/p/50afbb/32.png) [@Piyush\_Bansal](https://forum.ansible.com/u/Piyush_Bansal)\
**Post date:** [October 15, 2019, 7:48am UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/4 "2019-10-15T07:48:22Z")

</div>

Hello Sushena,

Hope you are doing well…!!  
I have faced exact same situation and it got resolved.

Please Could u give me following:

-nslookup of the member server fqdn you are pinging from ansible server  
-Output of command setspn -l   
-ansible hosts file section which shows the server names on which u r running this module  
-how many network interfaces you have on your ansible server  
-are these network interfaces on ansible server in same subnet range or mask ???

Thanks,  
Piyush  
9650865898

---

<div class="post-metadata">

**Author:** ![Amal\_Antony](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@Amal\_Antony](https://forum.ansible.com/u/Amal_Antony)\
**Post date:** [October 17, 2019, 12:46pm UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/5 "2019-10-17T12:46:35Z")

</div>

Hi Piyush Bansal,

Thanks for your response, I work along with **Sushena**. Below are the technical details

- nslookup working correctly and resolving eachother.
- only one network interface.
- hosts file entry: **testhost.NORTHIND.INTERNAL**

Thanks,

Amal Antony

---

<div class="post-metadata">

**Author:** ![Amal\_Antony](https://avatars.discourse-cdn.com/v4/letter/a/eada6e/32.png) [@Amal\_Antony](https://forum.ansible.com/u/Amal_Antony)\
**Post date:** [October 17, 2019, 12:53pm UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/6 "2019-10-17T12:53:25Z")

</div>

Hi Piyush,

Please find below snippet from ansible command for further understanding,

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [October 22, 2019, 11:47am UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/7 "2019-10-22T11:47:16Z")

</div>

Server not found in kerberos database means that the domain controller is unaware of the server. You mention using hosts file which suggests to me that the machine you want to connect to has not been joined to the domain. You almost certainly wouldn't need to use hosts file as typically joining a machine to a domain also adds to to your local DNS servers.

Hope this helps,

Jon

---

<div class="post-metadata">

**Author:** ![Sushena\_Parthasarath](https://avatars.discourse-cdn.com/v4/letter/s/7ea924/32.png) [@Sushena\_Parthasarath](https://forum.ansible.com/u/Sushena_Parthasarath)\
**Post date:** [November 18, 2019, 6:03am UTC](https://forum.ansible.com/t/ansible-v2-7-kerberos-authgssclientstep-failed/30906/8 "2019-11-18T06:03:15Z")

</div>

thanks, Jon

We have **SOLVED** the issue. The problem was with the NTP service where the Ansible controller and Domain controller wasn’t in sync. Post setting **ntpd** on the controller and changed ntp to UTC format, Service account and playbooks were working as expected.

thanks and everyone for assisting us.