# Issues with Kerberos Credential Delegation

**URL:** <https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136>\
**Category:** Get Help\
**Tags:** credentials, windows\
**Created:** [June 3, 2025, 3:14pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136 "2025-06-03T15:14:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\
**Post date:** [June 3, 2025, 3:14pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/1 "2025-06-03T15:14:47Z")

</div>

Folks

I’ve started getting issues with Kerberos credential delegation

I’m doing something like this

```auto
- name: "Copy File From Network Share"
  ansible.windows.win_copy:
    src: \\path\to\file.txt
    dest: C:\Temp\Test\
    remote_src: True
  become: True
  become_method: runas
  become_flags: logon_type=new_credentials logon_flags=netcredentials_only
  vars:
    ansible_become_user: "{{ ansible_user_id }}" 

```

and then I am running this with  
`ansible -i inventories/my_inventory.ini target_host copy_test.yml -u ansible_user_name -k -K`

and get an error indicating that the file does not exist. I have verified that the files do exist, and that the user has permissions to them.

I’ve been working through both the [double hop](https://www.redhat.com/en/blog/making-double-hop-windows-ansible) and [winrm setup](https://docs.ansible.com/ansible/latest/os_guide/windows_winrm.html) guides, specifically around kerberos and delegation.

Additionally, this “used to work” (as reported by the playbook authors).

The only thing I’ve found that might be relevant is [cve-2025-26647](https://support.microsoft.com/en-us/topic/protections-for-cve-2025-26647-kerberos-authentication-5f5d753b-4023-4dd3-b7b7-c8b104933d53) indicating a change in kerberos from Microsoft. My initial read of the provided documentation doesn’t seem like it would specifically impact this authentication flow, but the timing is too suspicious to ignore.

Has anyone see similar issues since that patch was deployed? Does anyone know of any work arounds (either in ansible directly, or domain changes)

Thanks.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [June 4, 2025, 4:45pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/2 "2025-06-04T16:45:34Z")

</div>

> The only thing I’ve found that might be relevant is [cve-2025-26647](https://support.microsoft.com/en-us/topic/protections-for-cve-2025-26647-kerberos-authentication-5f5d753b-4023-4dd3-b7b7-c8b104933d53) indicating a change in kerberos from Microsoft

That CVE is for Kerberos certificates and not something relevent to your playbook. Also just to be clear the become work used in Ansible is not related to Kerberos delegation, it is something done outside of the authentication mechanism that Kerberos sits at.

One thing I highly recommend you do is try it out with a hardcoded `ansible_become_user` and `ansible_become_pass` variable. That way you can complete rule out whether an incorrect variable or some other reference not passing through properly.

```yaml
- name: "Copy File From Network Share"
  ansible.windows.win_copy:
    src: \\path\to\file.txt
    dest: C:\Temp\Test\
    remote_src: True
  become: True
  become_method: runas
  become_flags: logon_type=new_credentials logon_flags=netcredentials_only
  vars:
    ansible_become_user: hard code username
    ansible_become_pass: hard code password

```

This is just for a test to run with and verify whether become is working or not. I wouldn’t recommend using this method in a real environment.

If you were wanting to try out Kerberos delegation without become then using `klist.exe` on the remote side is your friend. It’ll show the Kerberos TGT information for the current session. [Kerberos Authentication — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/os_guide/windows_winrm_kerberos.html#delegation) goes into a lot more detail around Kerberos delegation and how to debug things there.

---

<div class="post-metadata">

**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\
**Post date:** [June 4, 2025, 5:37pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/3 "2025-06-04T17:37:21Z")

</div>

> [@jborean](#):
>
> That CVE is for Kerberos certificates and not something relevent to your playbook. Also just to be clear the become work used in Ansible is not related to Kerberos delegation, it is something done outside of the authentication mechanism that Kerberos sits at.

That was my reading too. But the timing makes me suspicious.

> [@jborean](#):
>
> One thing I highly recommend you do is try it out with a hardcoded `ansible_become_user` and `ansible_become_pass` variable. That way you can complete rule out whether an incorrect variable or some other reference not passing through properly.

I’ll give this a try just to confirm, thanks.

---

<div class="post-metadata">

**Author:** ![Lyle\_McKarns](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/lyle_mckarns/32/8142_2.png) [@Lyle\_McKarns](https://forum.ansible.com/u/Lyle_McKarns)\
**Post date:** [June 19, 2025, 2:58pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/4 "2025-06-19T14:58:15Z")

</div>

This turned out to be an issue with the system providing the share not having the correct SPNs associated with it.

So when trying to do the second hop authentication, it was trying to auth to a machine “didn’t exist”.

Thanks to @jborean for the insights and helping me eliminate other possible causes.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [June 20, 2025, 11:32am UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/5 "2025-06-20T11:32:55Z")

</div>

Ah thanks for sharing what happened. That’s a good point to put on the docs and come up with a nice way to test it out. Kerberos delegation can only work if the outbound auth also uses Kerberos so if there is anything that would stop that (IPs, mismatched SPN, etc) then it won’t work. I’ll look at updating the docs with this sometime soon.

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [June 30, 2025, 9:12pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/6 "2025-06-30T21:12:30Z")

</div>

I’ve opened [Add more Windows Kerberos delegation info by jborean93 · Pull Request #2779 · ansible/ansible-documentation · GitHub](https://github.com/ansible/ansible-documentation/pull/2779) which adds an example on testing out the service ticket retrieval to the docs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [July 30, 2025, 9:13pm UTC](https://forum.ansible.com/t/issues-with-kerberos-credential-delegation/43136/7 "2025-07-30T21:13:27Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.