# Ansible WinRM Kerberos Authentication **URL:** \ **Category:** Get Help\ **Tags:** windows\ **Created:** [February 3, 2025, 8:59pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026 "2025-02-03T20:59:41Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Fragger\_Lagger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fragger_lagger/32/7468_2.png) [@Fragger\_Lagger](https://forum.ansible.com/u/Fragger_Lagger)\ **Post date:** [February 3, 2025, 8:59pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/1 "2025-02-03T20:59:41Z")
Hi, I am trying to run win\_ping module using the adhoc command through ansible against domain controller through winrm and kerberos authentication. Issue is when I create an Environment Variable KRB5\_CONFIG=/tmp/krb5.conf ansible is not picking up the Env and defaulting to whatever is in /etc/krb5.conf and hence failing to work as it’s not able to find the REALM in the database as it doesn’t exist in /etc/krb5.conf but in /tmp/krb5.conf. Is there any other way to supply the Environment Variable so that ansible knows where to find the kerberos config instead of just picking it up from default location. The environment variable works fine if I run the kinit user@REALM command and after supplying the password it gets the ticket. The variable was setup correctly using export KRB5\_CONFIG=/tmp/krb5.conf And the following was used for testing ansible all -i “dc01,” -m win\_ping -e ansible\_user=domainadmin@REALM -e ansible\_password=\*\*\* -e ansible\_connection=winrm -e ansible\_winrm\_transport= kerberos -e ansible\_winrm\_cert\_validation=ignore ---
**Author:** ![nwerker](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/nwerker/32/1270_2.png) [@nwerker](https://forum.ansible.com/u/nwerker)\ **Post date:** [February 3, 2025, 9:57pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/2 "2025-02-03T21:57:27Z")
Hey @Fragger_Lagger, first of all welcome to the ansible community forum! Nice to have you onboard. Have you set the variable [kinit\_env\_vars](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/winrm_connection.html#parameter-kinit_env_vars)? If I remember correctly I think that ansible isn’t forwarding ENV per default and the desired ENV that is getting parsed to kinit has to be specified via. this variable. Hope this helps! Although I’m not a windows expert, I’m happy to help with windows related questions! ---
**Author:** ![Fragger\_Lagger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fragger_lagger/32/7468_2.png) [@Fragger\_Lagger](https://forum.ansible.com/u/Fragger_Lagger)\ **Post date:** [February 4, 2025, 3:32pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/3 "2025-02-04T15:32:40Z")
Hey @ [nwerker](https://forum.ansible.com/u/nwerker) Thanks for the response. I tried like this but it isn’t working. ansible all -i “dc01,” -m win\_ping -e ansible\_user=diradmin@PROD -e ansible\_password=\*\*\*\* -e ansible\_connecti on=winrm -e ansible\_winrm\_transport=kerberos -e ansible\_winrm\_cert\_validation=ignore -e ansible\_winrm\_kinit\_env\_vars=[“KRB5\_CONFIG=/home/anvil/krb5.conf”] ---
**Author:** ![nwerker](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/nwerker/32/1270_2.png) [@nwerker](https://forum.ansible.com/u/nwerker)\ **Post date:** [February 4, 2025, 4:21pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/4 "2025-02-04T16:21:50Z")
Have you tried only specifying the name of the environment variable, not the whole key + value?! Like: ```auto ansible all -i “dc01,” -m win_ping -e ansible_user=diradmin@PROD -e ansible_password= **** -e ansible_connection=winrm -e ansible_winrm_transport=kerberos -e ansible_winrm_cert_validation=ignore -e ansible_winrm_kinit_env_vars=[“KRB5_CONFIG”] ``` ---
**Author:** ![Fragger\_Lagger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fragger_lagger/32/7468_2.png) [@Fragger\_Lagger](https://forum.ansible.com/u/Fragger_Lagger)\ **Post date:** [February 4, 2025, 4:52pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/5 "2025-02-04T16:52:28Z")
Thanks for the response @nwerker. Unfortunately it still didn’t work. It’s not picking up the Configuration from the environment variable. ---
**Author:** ![ITJoeSchmo](https://avatars.discourse-cdn.com/v4/letter/i/ebca7d/32.png) [@ITJoeSchmo](https://forum.ansible.com/u/ITJoeSchmo)\ **Post date:** [February 4, 2025, 5:12pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/6 "2025-02-04T17:12:15Z")
Funny enough, I have been trying to achieve the same thing for the same exact reasons. I finally got something working based off of: [BuildingTents | Giving the campers something to read while they guard the flag](https://buildingtents.com/) have krb5.conf in ~/ make kinit.sh in ~/ > #!/bin/bash > > cd “$(dirname “$0”)” > > export KRB5\_CONFIG=./krb5.conf > > kinit $1 make executable > chmod +x ~/kinit.sh in your ansible-playbook line, add this extra var: > –extra-vars “ansible\_winrm\_kinit\_cmd=/home/[USERNAME]/kinit.sh” ---
**Author:** ![Fragger\_Lagger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fragger_lagger/32/7468_2.png) [@Fragger\_Lagger](https://forum.ansible.com/u/Fragger_Lagger)\ **Post date:** [February 4, 2025, 5:47pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/7 "2025-02-04T17:47:42Z")
Thanks @ITJoeSchmo for the response. Your solution changed the error. Seems like it picked up the REALM but it’s not picking up the password supplied through `ansible_password` variable. I am getting this error ```auto Kerberos auth failure for principal diradmin@PROD with subprocess: kinit: Pre-authentication failed: Cannot read password while getting initial credentials. ``` ---
**Author:** ![Fragger\_Lagger](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/fragger_lagger/32/7468_2.png) [@Fragger\_Lagger](https://forum.ansible.com/u/Fragger_Lagger)\ **Post date:** [February 4, 2025, 6:02pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/8 "2025-02-04T18:02:20Z")
Update @ITJoeSchmo It’s still not picking up the Correct REALM and correct configuration. If I remove the REALM from the user it doesn’t pick the proper configuration. ---
**Author:** ![ITJoeSchmo](https://avatars.discourse-cdn.com/v4/letter/i/ebca7d/32.png) [@ITJoeSchmo](https://forum.ansible.com/u/ITJoeSchmo)\ **Post date:** [February 4, 2025, 6:51pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/9 "2025-02-04T18:51:49Z")
I think the only time you can exclude the REALM is if you have a default set in the krb5.conf file e.g. ```auto # Default values used by the Kerberos V5 library [libdefaults] default_realm = DOMAIN.TLD dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h renew_lifetime = 7d forwardable = true rdns = false ``` My ansible\_\* vars are being defined by a .yml in the ./inventory dir, but it seems to more or less match what you’re defining inline: ```auto ansible_user: [USING HASHIVAULT PLUGIN TO LOOKUP VALUE] ansible_password: [USING HASHIVAULT PLUGIN TO LOOKUP VALUE] ansible_connection: winrm ansible_winrm_transport: kerberos ansible_winrm_server_cert_validation: ignore ansible_port: 5985 ``` Now that I think about it, does your password value have symbols? I recall some issues where a password was not being parsed as expected because of symbols. [Advanced playbook syntax — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_advanced_syntax.html) and Some examples of how the extra var is processed using a simple play that just outputs the var: ```auto - name: Test string output ansible.builtin.debug: msg: "{{ testString }}" ``` ```auto ansible-playbook test.yml --extra-vars testString=test@#$!~%^&*()_-+= ``` ```auto [1] 3311782 bash: *()_-+=: command not found TASK [Test string output] ******************************************************************************************************************************************************************* ok: [localhost] => msg: test@#~%^ ``` Notice it even caused a separate line of bash to execute by the first 2 lines of output I cant seem to find a way to set an extra var as unsafe, AWX Tower does this by default but that is not really applicable here, only mentioning it in case you’re not familiar with AWX and see similar in search results. I think you should try to set all your vars in a file where you can easily set !unsafe and see if that helps. [Using Variables — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_variables.html#vars-from-a-json-or-yaml-file) Make winrm\_vars.yml ```auto type or paste code hereansible_user: domainadmin@REALM ansible_password: !unsafe 234%234{435lkj{{lkjsdf ansible_connection: winrm ansible_winrm_transport: kerberos ansible_winrm_cert_validation: ignore ``` Then run this to test: ```auto ansible all -i "dc01"-m win_ping --extra-vars "@winrm_vars.yml" ``` Example of how tagging unsafe preserves the value as expected test\_vars.yml ```auto unsafeString: !unsafe test@#$!~%^&*()_-+= ``` ```auto ansible-playbook test.yml --extra-vars @"test_vars.yml" ``` ```auto TASK [Test string output] ******************************************************************************************************************************************************************* ok: [localhost] => msg: test@#$!~%^&*()_-+= ``` ---
**Author:** ![ITJoeSchmo](https://avatars.discourse-cdn.com/v4/letter/i/ebca7d/32.png) [@ITJoeSchmo](https://forum.ansible.com/u/ITJoeSchmo)\ **Post date:** [February 5, 2025, 4:40pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/10 "2025-02-05T16:40:41Z")
I also just realized on top of the steps I had provided in my post #5 to use krb5.conf, you need to run: ```auto export KRB5_CONFIG=./krb5.conf ``` in your shell session as well, not just set it in the kinit.sh ---
**Author:** ![bartowl](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/bartowl/32/7029_2.png) [@bartowl](https://forum.ansible.com/u/bartowl)\ **Post date:** [February 10, 2025, 3:39pm UTC](https://forum.ansible.com/t/ansible-winrm-kerberos-authentication/40026/11 "2025-02-10T15:39:08Z")
When using `ansible_host` hostvars that point to something else than FQDN (for example IP address) do not forget to set in addition `ansible_winrm_kerberos_hostname_override` variable to the FQDN the host is registered with in kerberos realm. Otherwise It won’t authenticate as it cannot find the host in krb.