# kerberos configuration to ping Windows server with Ansible **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [August 4, 2016, 6:50am UTC](https://forum.ansible.com/t/kerberos-configuration-to-ping-windows-server-with-ansible/22211 "2016-08-04T06:50:49Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![fanvalt](https://avatars.discourse-cdn.com/v4/letter/f/2bfe46/32.png) [@fanvalt](https://forum.ansible.com/u/fanvalt)\ **Post date:** [August 4, 2016, 6:50am UTC](https://forum.ansible.com/t/kerberos-configuration-to-ping-windows-server-with-ansible/22211/1 "2016-08-04T06:50:49Z")
Hello, I am new in Windows and in Kerberos, following the [http://docs.ansible.com/ansible/intro\_windows.html](http://docs.ansible.com/ansible/intro_windows.html) documentation, I tried to parameter kerberos and then ping the windows server without success. Here is the issue: - The credentials to connect to the Windows server are controlled by a ldap server: [fr.ldap-ad.dmsi.corp.com](http://fr.ldap-ad.dmsi.corp.com) - My Windows server’s name is [swin02.fr.com](http://swin02.fr.com) - On the Windows server, my user is in a EMEAD domain - On Centos, I tried to parameter the /etc/krb5.conf file , I don’t understand if the ldap server can be set in the kbc or admin\_server and what domain has to be set (the one of the user EMEAD, of the server [fr.com](http://fr.com) ? ): [realms] [EXAMPLE.COM](http://EXAMPLE.COM) = { kdc = [kerberos.example.com](http://kerberos.example.com) admin\_server = [kerberos.example.com](http://kerberos.example.com) } [EMEAD.COM](http://EMEAD.COM) = { kdc = [fr.ldap-ad.dmsi.corp.com](http://fr.ldap-ad.dmsi.corp.com) } [FR.COM](http://FR.COM) = { kdc = [fr.ldap-ad.dmsi.corp.com](http://fr.ldap-ad.dmsi.corp.com) } [domain\_realm] [example.com](http://example.com) = [EXAMPLE.COM](http://EXAMPLE.COM) [emead.com](http://emead.com) = [EMEAD.COM](http://EMEAD.COM) [fr.com](http://fr.com) = [FR.COM](http://FR.COM) Thanks for your support ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [August 4, 2016, 7:16am UTC](https://forum.ansible.com/t/kerberos-configuration-to-ping-windows-server-with-ansible/22211/2 "2016-08-04T07:16:58Z")
I have only ever used kerberos support with Active Directory servers, not LDAP ones. However, I think from what you have described that your kdc will be fr.[ldap-ad.dmsi.corp.com](http://ldap-ad.dmsi.corp.com) I don’t think you need an admin server set up for this purpose ( I don’t have one set in my krb5.conf) You may have a domain alias in place in which case you may not know the canonical name for the domain you are authenticating with. I suggest you try running kinit -C [someuser@EMEAD.COM](mailto:someuser@EMEAD.COM) and then running klist. This should show the actual domain used to authenticate. That domain what you will need to set up in /etc/krb5.conf and use in ansible. Also I understand it is possible to set up domain trust relationships so that users of domain A are allowed to use machines belonging to domain B. I only tried this briefly and didn’t get it working and wound up setting up machines on the same domain as the user. Probably worth talking to your domain administrators to discover if you have domain trust relationships set up. I hope this helps. There is a little more information here: [http://docs.ansible.com/ansible/intro\_windows.html#troubleshooting-kerberos-connections](http://docs.ansible.com/ansible/intro_windows.html#troubleshooting-kerberos-connections) Jon ---
**Author:** ![fanvalt](https://avatars.discourse-cdn.com/v4/letter/f/2bfe46/32.png) [@fanvalt](https://forum.ansible.com/u/fanvalt)\ **Post date:** [August 4, 2016, 8:27am UTC](https://forum.ansible.com/t/kerberos-configuration-to-ping-windows-server-with-ansible/22211/3 "2016-08-04T08:27:29Z")
I did correct the krb5.conf file, I did install the requests.kerberos package and rerun the kinit command. The klist command shows the [EMEAD.COM](http://EMEAD.COM) domain. But when running the ansible win\_ping command, I do receive this new message: ansible windows -i ./win.ini -m win\_ping -vvvvvv Using /etc/ansible/ansible.cfg as config file Loaded callback minimal of type stdout, v2.0 \<172.17.56.66\> ESTABLISH WINRM CONNECTION FOR USER: [fvaltat@EMEAD.COM](mailto:fvaltat@EMEAD.COM) on PORT 5986 TO 172.17.56.66 \<172.17.56.66\> WINRM CONNECT: transport=kerberos endpoint=[https://172.17.56.66:5986/wsman](https://172.17.56.66:5986/wsman) \<172.17.56.66\> WINRM CONNECTION ERROR: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377)) I guess because the server is not on the [EMEAD.COM](http://EMEAD.COM) domain, there is an issue ? I don’t understand how all this works Regards ---
**Author:** ![fanvalt](https://avatars.discourse-cdn.com/v4/letter/f/2bfe46/32.png) [@fanvalt](https://forum.ansible.com/u/fanvalt)\ **Post date:** [August 4, 2016, 9:01am UTC](https://forum.ansible.com/t/kerberos-configuration-to-ping-windows-server-with-ansible/22211/4 "2016-08-04T09:01:52Z")
Oh the win\_ping command did work, I did replace the IP address in the inventory file with the server name and I did comment in the krb5.conf file all descriptions that were not about [EMEAD.COM](http://EMEAD.COM) (so many tests !!!). Thanks a lot, Jon, for your support Regards ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [August 4, 2016, 4:23pm UTC](https://forum.ansible.com/t/kerberos-configuration-to-ping-windows-server-with-ansible/22211/5 "2016-08-04T16:23:32Z")
Great, I’m glad this is working. Setting up kerberos is fiddly but once it’s done you probably won’t have to touch it again and you can immediately start doing a lot of things with a lot of windows boxes. JOn