# Kerberos Auth - the specified credentials were rejected by the server

**URL:** <https://forum.ansible.com/t/kerberos-auth-the-specified-credentials-were-rejected-by-the-server/24104>\
**Category:** Ansible Project\
**Tags:** ansible-project\
**Created:** [March 30, 2017, 5:36pm UTC](https://forum.ansible.com/t/kerberos-auth-the-specified-credentials-were-rejected-by-the-server/24104 "2017-03-30T17:36:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![meaton](https://avatars.discourse-cdn.com/v4/letter/m/258eb7/32.png) [@meaton](https://forum.ansible.com/u/meaton)\
**Post date:** [March 30, 2017, 5:36pm UTC](https://forum.ansible.com/t/kerberos-auth-the-specified-credentials-were-rejected-by-the-server/24104/1 "2017-03-30T17:36:50Z")

</div>

Hey.

How do I check the spn? I’ve already applied that pull to pywinrm…

Thanks.

Michael

---

<div class="post-metadata">

**Author:** ![Mike\_Fennemore](https://avatars.discourse-cdn.com/v4/letter/m/45deac/32.png) [@Mike\_Fennemore](https://forum.ansible.com/u/Mike_Fennemore)\
**Post date:** [March 30, 2017, 6:05pm UTC](https://forum.ansible.com/t/kerberos-auth-the-specified-credentials-were-rejected-by-the-server/24104/2 "2017-03-30T18:05:22Z")

</div>

Also might want to check reverse DNS entry for the host your connecting to. It needs to be resolvable from the Ansible node.

---

<div class="post-metadata">

**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\
**Post date:** [March 30, 2017, 11:00pm UTC](https://forum.ansible.com/t/kerberos-auth-the-specified-credentials-were-rejected-by-the-server/24104/3 "2017-03-30T23:00:47Z")

</div>

Something like this will do it: [https://social.technet.microsoft.com/wiki/contents/articles/18996.list-all-spns-used-in-your-active-directory.aspx](https://social.technet.microsoft.com/wiki/contents/articles/18996.list-all-spns-used-in-your-active-directory.aspx)

Oftentimes it’s some random piece of software that reassigns a host’s HTTP SPNs to do Kerberos in IIS with a custom user account. Normally the HTTP SPN is “implicit”, so it shouldn’t be assigned anywhere.