# Kerberos Support **URL:** \ **Category:** AWX Project\ **Tags:** windows, awx\ **Created:** [April 13, 2021, 1:17pm UTC](https://forum.ansible.com/t/kerberos-support/34971 "2021-04-13T13:17:14Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Christopher\_Billett](https://avatars.discourse-cdn.com/v4/letter/c/edb3f5/32.png) [@Christopher\_Billett](https://forum.ansible.com/u/Christopher_Billett)\ **Post date:** [April 13, 2021, 1:17pm UTC](https://forum.ansible.com/t/kerberos-support/34971/1 "2021-04-13T13:17:14Z")
Does the current AWX Operator support the setup of Realms in Kerberos? I need to look into Windows host management through Ansible, but cannot see a method of injecting the realms data into the krb5.conf file. What alternative (secure) methods does the operator currently support for WinRM host auth. ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [April 13, 2021, 1:19pm UTC](https://forum.ansible.com/t/kerberos-support/34971/2 "2021-04-13T13:19:14Z")
I am going to create a config map with the krb5.conf file in etc/krb5.conf. I will inject in awx task pod ---
**Author:** ![Brandon\_Ellis](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@Brandon\_Ellis](https://forum.ansible.com/u/Brandon_Ellis)\ **Post date:** [April 13, 2021, 8:02pm UTC](https://forum.ansible.com/t/kerberos-support/34971/3 "2021-04-13T20:02:29Z")
I posted a way how to do this [here on this issue](https://github.com/ansible/awx/issues/9807#issuecomment-819014975) It deploys fine and kinit works, but I haven’t gotten the time to test playbooks yet ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [April 14, 2021, 4:55am UTC](https://forum.ansible.com/t/kerberos-support/34971/4 "2021-04-14T04:55:21Z")
[@Brandon Ellis](mailto:bellis2@umbc.edu) i am trying to recreate what you are doing but I am lost. Which part of the spec do you put that? That’s the exact scenario I am wanting to do ---
**Author:** ![Brandon\_Ellis](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@Brandon\_Ellis](https://forum.ansible.com/u/Brandon_Ellis)\ **Post date:** [April 14, 2021, 11:42am UTC](https://forum.ansible.com/t/kerberos-support/34971/5 "2021-04-14T11:42:29Z")
At the custom resource specification “spec” field in the my-awx.yml file mentioned in the awx-operator git README. Basically the same block where the ingress\_type is specified. It turns out that the devs left in some secret custom variables so you can add in custom volumes and volume mounts. Here’s my current “my-awx.yml” deployment spec file I’m using. It’s got some weird ${} and %{} syntax because I preprocess the file using terraform to add in variable values – feel free to replace any ${} block with your desired value. (Note that if you were to use the krb5.conf file in here, you’d need to replace %%{uid} with %{uid}). ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [April 14, 2021, 5:44pm UTC](https://forum.ansible.com/t/kerberos-support/34971/6 "2021-04-14T17:44:03Z")
Thank you Brandon, I followed your example and did a test. As you said kinit does work. I just needed the volume. So following your example is much needed. Thanks once again. ---
**Author:** ![Brandon\_Ellis](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@Brandon\_Ellis](https://forum.ansible.com/u/Brandon_Ellis)\ **Post date:** [April 15, 2021, 4:15pm UTC](https://forum.ansible.com/t/kerberos-support/34971/7 "2021-04-15T16:15:53Z")
Glad I could be of help ---
**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\ **Post date:** [September 24, 2021, 7:58pm UTC](https://forum.ansible.com/t/kerberos-support/34971/8 "2021-09-24T19:58:41Z")
Ran into similar issue, tried following in the AWX instance YAML but still getting following error. Would it make a difference ‘tower’ prefix for the variables? I have these entries too under [libdefaults] default\_tgs\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 **“msg”: “Kerberos auth failure for principal [windows\_id@MYORG.COM](mailto:windows_id@MYORG.COM) with pexpect: KDC has no support for encryption type while getting initial credentials”,** extra\_volumes: | - name: krb5 configMap: defaultMode: 420 items: - key: krb5.conf path: krb5.conf name: krb5-conf task\_extra\_volume\_mounts: | - name: krb5 mountPath: /etc/krb5.conf subPath: krb5.conf ee\_extra\_volume\_mounts: | - name: krb5 mountPath: /etc/krb5.conf subPath: krb5.conf ---
**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\ **Post date:** [September 24, 2021, 9:30pm UTC](https://forum.ansible.com/t/kerberos-support/34971/9 "2021-09-24T21:30:17Z")
Contents of the krb5.conf file from the task container. sh-4.4$ cat /etc/krb5.conf # To opt out of the system crypto-policies configuration of krb5, remove the symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated. includedir /etc/krb5.conf.d/ [logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin\_server = FILE:/var/log/kadmind.log [libdefaults] dns\_lookup\_realm = false ticket\_lifetime = 24h renew\_lifetime = 7d forwardable = true rdns = false pkinit\_anchors = FILE:/etc/pki/tls/certs/ca-bundle.crt spake\_preauth\_groups = edwards25519 default\_realm = [MYORG.COM](http://MYORG.COM) default\_tgs\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 [realms] [MYORG.COM](http://MYORG.COM) = { kdc = [dfgdfdc4344.myorg.com](http://dfgdfdc4344.myorg.com) admin\_server = [dfgdfdc4344.myorg.com](http://dfgdfdc4344.myorg.com) } [domain\_realm] .myorg.com = [MYORG.COM](http://MYORG.COM) [myorg.com](http://myorg.com) = [MYORG.COM](http://MYORG.COM) ---
**Author:** ![Wei-Yen\_Tan](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/wei-yen_tan/32/4111_2.png) [@Wei-Yen\_Tan](https://forum.ansible.com/u/Wei-Yen_Tan)\ **Post date:** [September 24, 2021, 9:31pm UTC](https://forum.ansible.com/t/kerberos-support/34971/10 "2021-09-24T21:31:56Z")
default\_tgs\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 default\_tkt\_enctypes = arcfour-hmac-md5 des-cbc-crc des-cbc-md5 Why have this ---
**Author:** ![Cnu\_k](https://avatars.discourse-cdn.com/v4/letter/c/a88e4f/32.png) [@Cnu\_k](https://forum.ansible.com/u/Cnu_k)\ **Post date:** [September 25, 2021, 1:52pm UTC](https://forum.ansible.com/t/kerberos-support/34971/11 "2021-09-25T13:52:44Z")
I had to add these entries for AWX 17.1.0 task container for making Windows connections to work, so I did the same for 19.2.2 as well. Apparently it’s not working. Not sure if something has changed with this version or some other issue. Thanks