# Domain / LDAP User running Ansible from a CI Server

**URL:** <https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [October 27, 2015, 5:21am UTC](https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620 "2015-10-27T05:21:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![David\_O\_Brien](https://avatars.discourse-cdn.com/v4/letter/d/c0e974/32.png) [@David\_O\_Brien](https://forum.ansible.com/u/David_O_Brien)\
**Post date:** [October 27, 2015, 5:21am UTC](https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620/1 "2015-10-27T05:21:55Z")

</div>

Hi,

is anybody running Ansible from a CI Server (Teamcity, Jenkins, GoCD) using a Domain User / LDAP user to connect to a Windows machine?

We are currently facing the issue of “How to automatically create / renew the kerberos ticket”.

How do other people tackle this?

The problem is that kinit, if run from a playbook, will log the whole call in cleartext, including the password. Obviously not acceptable.

Guidance appreciated.

Cheers  
David

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [October 27, 2015, 1:49pm UTC](https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620/2 "2015-10-27T13:49:41Z")

</div>

Just wondering if setting no\_log: True on your task would do the trick:

[http://docs.ansible.com/ansible/faq.html#how-do-i-keep-secret-data-in-my-playbook](http://docs.ansible.com/ansible/faq.html#how-do-i-keep-secret-data-in-my-playbook)

---

<div class="post-metadata">

**Author:** ![David\_O\_Brien](https://avatars.discourse-cdn.com/v4/letter/d/c0e974/32.png) [@David\_O\_Brien](https://forum.ansible.com/u/David_O_Brien)\
**Post date:** [October 28, 2015, 3:54am UTC](https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620/3 "2015-10-28T03:54:03Z")

</div>

The system however would still have it in its shell history, right?

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [October 28, 2015, 12:44pm UTC](https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620/4 "2015-10-28T12:44:43Z")

</div>

local history will have the ansible invocation, the remote history  
should have at most the ansible modules run (but no args). Most of the  
time ansible uses not interactive sessions which should not write to  
history file.

---

<div class="post-metadata">

**Author:** ![David\_O\_Brien](https://avatars.discourse-cdn.com/v4/letter/d/c0e974/32.png) [@David\_O\_Brien](https://forum.ansible.com/u/David_O_Brien)\
**Post date:** [October 28, 2015, 10:04pm UTC](https://forum.ansible.com/t/domain-ldap-user-running-ansible-from-a-ci-server/19620/5 "2015-10-28T22:04:27Z")

</div>

I will give it a go.

Would still wish that we could just go, tell Ansible to use a domain user and it would get a ticket by itself. ☹