# Kerberos config that works fine with AWX 17.1.0 wouldn't work in version 19.2.2 **URL:** \ **Category:** AWX Project\ **Tags:** windows, awx\ **Created:** [September 27, 2021, 5:49pm UTC](https://forum.ansible.com/t/kerberos-config-that-works-fine-with-awx-17-1-0-wouldnt-work-in-version-19-2-2/35788 "2021-09-27T17:49:18Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\ **Post date:** [September 27, 2021, 5:49pm UTC](https://forum.ansible.com/t/kerberos-config-that-works-fine-with-awx-17-1-0-wouldnt-work-in-version-19-2-2/35788/1 "2021-09-27T17:49:18Z")
I have multiple AWX instances running fine with AWX 17.10 version for past year or so without any issues with below Kerberos config(/etc/krb5.conf in the task container). As part of the upgrade, I have deployed AWX 19.2.2 in OpenShift cluster, noticed that same krb5.conf is injected into the task container as a ConfigMap and I have compared and verified the contents multiple times, and the content matches exactly with the existing config. Error: fatal: [windows\_server\_name.org.com]: UNREACHABLE! =\> { “changed”: false, “msg”: “Kerberos auth failure for principal [windows\_id@CORP.ORG.COM](mailto:windows_id@CORP.ORG.COM) with pexpect: KDC has no support for encryption type while getting initial credentials”, “unreachable”: true } /etc/krb5.conf contents: # To opt out of the system crypto-policies configuration of krb5, remove the # symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin\_server = FILE:/var/log/kadmind.log [libdefaults] dns\_lookup\_realm = false ticket\_lifetime = 24h renew\_lifetime = 7d forwardable = true rdns = false pkinit\_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake\_preauth\_groups = edwards25519 default\_realm = [CORP.ORG.COM](http://CORP.ORG.COM) # Added below 2 entries to resolve ‘KDC has no support for encryption type while getting initial credentials’ error while connecting to Windows Server default\_tgs\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 [realms] [CORP.ORG.COM](http://CORP.ORG.COM) = { kdc = [server1.corp.org.com](http://server1.corp.org.com) admin\_server = [server1.corp.org.com](http://server1.corp.org.com) } [domain\_realm] .corp.org.com = [CORP.ORG.COM](http://CORP.ORG.COM) [corp.org.com](http://corp.org.com) = [CORP.ORG.COM](http://CORP.ORG.COM) Note that authentication is done against Microsoft Active Directory(AD), I see the same error when I tried kinit [windows\_id@CORP.ORG.COM](mailto:windows_id@CORP.ORG.COM) in SSH terminal for the task container. Same command works fine in the old task container terminal(17.2.2). Could this be due to any missing libraries or other? Any help is really appreciated as I am unable to proceed further. Thanks ---
**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\ **Post date:** [September 29, 2021, 3:15pm UTC](https://forum.ansible.com/t/kerberos-config-that-works-fine-with-awx-17-1-0-wouldnt-work-in-version-19-2-2/35788/2 "2021-09-29T15:15:13Z")
No clue why it’s working now versus it didn’t work earlier with the default EE images. Created a custom EE image for adding open ldap utilities, jq, and wget tools, other than that it’s pretty much out of box EE image. ee\_images: - name: custom-awx-ee image: [myorg.private.repo.com:443/awx-ee:0.5.0](http://myorg.private.repo.com:443/awx-ee:0.5.0) control\_plane\_ee\_image: [middleware-docker-local.rtfx.aepsc.com:443/awx-ee:0.5.0](http://middleware-docker-local.rtfx.aepsc.com:443/awx-ee:0.5.0) I now have following entries in every AWX instance, verified that Windows WINRM connections with above krb5.conf file are working now. Here is the content of the above custom-awx-ee image Dockerfile if anyone is interested.