# Kerberos authentication failed on windows **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [July 27, 2020, 10:32pm UTC](https://forum.ansible.com/t/kerberos-authentication-failed-on-windows/33505 "2020-07-27T22:32:50Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Work\_Email](https://avatars.discourse-cdn.com/v4/letter/w/34f0e0/32.png) [@Work\_Email](https://forum.ansible.com/u/Work_Email)\ **Post date:** [July 27, 2020, 10:32pm UTC](https://forum.ansible.com/t/kerberos-authentication-failed-on-windows/33505/1 "2020-07-27T22:32:50Z")
Hello, Kerberos authentication is failing on some servers even after providing credentials in host file. **Host File** [windows\_server] [test.domain.com](http://test.domain.com) [windows:vars] ansible\_user=\*\*\*\*\* ansible\_password=\*\*\*\*\*\* ansible\_connection = winrm ansible\_ssh\_port = 5986 ansible\_winrm\_transport = kerberos ansible\_winrm\_server\_cert\_validation = ignore validate\_certs = false **Playbook:** hosts: windows\_server vars: ansible\_connection: winrm ansible\_ssh\_port: 5986 ansible\_winrm\_transport: kerberos ansible\_winrm\_server\_cert\_validation: ignore validate\_certs: false ansible\_winrm\_scheme: https ansible\_winrm\_read\_timeout\_sec: 30 ignore\_unreachable: true gather\_facts: false Note - If I provide kinit [test@domain.com](mailto:test@domain.com) (credentials) the playbook works for some servers and windows machines but not for others. Weird! Thanks, ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [July 28, 2020, 3:53am UTC](https://forum.ansible.com/t/kerberos-authentication-failed-on-windows/33505/2 "2020-07-28T03:53:48Z")
You need to share the error you are getting back, right now we cannot tell what is going wrong. ---
**Author:** ![Work\_Email](https://avatars.discourse-cdn.com/v4/letter/w/34f0e0/32.png) [@Work\_Email](https://forum.ansible.com/u/Work_Email)\ **Post date:** [July 28, 2020, 4:01pm UTC](https://forum.ansible.com/t/kerberos-authentication-failed-on-windows/33505/3 "2020-07-28T16:01:35Z")
Oh! Here is the reported error: fatal: [[test.domain.com](http://test.domain.com)]: UNREACHABLE! =\> {“changed”: false, “msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available (default cache: FILE:/tmp/krb5cc\_0)’, -1765328243))”, “unreachable”: true} hmmm… I believe credentials should be read from host file! I am not sure why it’s not reading. Thanks, Work Hard ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [July 28, 2020, 7:42pm UTC](https://forum.ansible.com/t/kerberos-authentication-failed-on-windows/33505/4 "2020-07-28T19:42:28Z")
That’s because you are telling it to run on windows\_server but have defined the username in the windows group. Based on your inventory ‘windows\_server’ is not part of the ‘windows’ group so has no username/password defined. The reason why it may have worked before is if you’ve gotten the Kerberos ticket manually outside of Ansible with kinit. I’ve said this before just recently to you in [https://groups.google.com/g/ansible-project/c/V3904K8n7eo/m/lP4b05yZBwAJ](https://groups.google.com/g/ansible-project/c/V3904K8n7eo/m/lP4b05yZBwAJ) but to repeat for the final time - The host you are running on is not in the ‘windows’ group so it will not inherit those variables defined there. The windows group is not a magic group that applies to all Windows hosts but an arbitrarily named one that should match how your inventory is set up - ansible\_winrm\_read\_timeout\_sec shouldn’t be set by you. There is little reason for someone to change this option and even so 30 seconds is the default so just remove that altogether - ignore\_unreachable, gather\_facts, validate\_certs don’t make sense as vars unless you are using it down in your playbook somewhere but based on your example it isn’t so just remove it altogether - If you did want to use ignore\_unreachable and gather\_facts, they are either play or task directives so putting them in vars is wrong. They should be indented to the same level as hosts in your play and ignore\_unreachable can be set per task as well You seem to be just building your playbook on various different components and trying variables left right and center. Start small and define your connection details in your host file like so [windows\_server] [test.domain.com](http://test.domain.com) ansible\_user=\*\*\*\*\*\* ansible\_password=\*\*\*\*\*\* [windows\_server:vars] ansible\_connection = winrm ansible\_port = 5986 ansible\_winrm\_transport = kerberos ansible\_winrm\_server\_cert\_validation = ignore Here is what I’ve changed from your inventory - Added the credentials to the actual host entry itself, typically these are per host but feel free to move them back to the group if multiple hosts have the same credentials - Changed the windows group to windows\_servers as that matches what’s in your playbook. Now the vars you’ve defined will be set on the hosts in the windows\_servers group - Changed ansible\_ssh\_port to ansible\_port - Removed validate\_certs as it wasn’t doing anything and would lead to confusion with ansible\_winrm\_server\_cert\_validation You should also remove all those connection vars in your playbook as it should be completely agnostic to how to connect to a host. All the playbook should be doing is define what hosts to use and the tasks to run, how to connect is what the inventory is for - name: example playbook hosts: windows\_server tasks: - name: first task to run win\_ping: