# "kerberos: (u'http', u'Bad HTTP response returned from server. Code 500'), plaintext: the specified credentials were rejected by the server" **URL:** \ **Category:** Ansible Project\ **Tags:** windows, ubuntu\ **Created:** [May 2, 2017, 3:19pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378 "2017-05-02T15:19:09Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Allen\_Fisher1](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@Allen\_Fisher1](https://forum.ansible.com/u/Allen_Fisher1)\ **Post date:** [May 2, 2017, 3:19pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/1 "2017-05-02T15:19:09Z")
Hi All– I’m running into an issue connecting from an Ubuntu 16.04 system to a Windows 2012 Server on a domain: > afisher@ubuntu:~/Projects/build-utils/ansible-playbooks$ ansible windows -i inventory.yml -m win\_ping -vvvv > Using /etc/ansible/ansible.cfg as config file > Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/dist-packages/ansible/plugins/callback/ **init**.pyc > [WARNING]: ansible\_winrm\_cert\_validation unsupported by pywinrm (is an up-to-date version of pywinrm installed?) > Using module file /usr/lib/python2.7/dist-packages/ansible/modules/core/windows/win\_ping.ps1 > \<[edprjenslave03.DOMAIN.COM](http://edprjenslave03.DOMAIN.COM)\> ESTABLISH WINRM CONNECTION FOR USER: [afisher@DOMAIN.COM](mailto:afisher@DOMAIN.COM) on PORT 5985 TO [edprjenslave03.DOMAIN.COM](http://edprjenslave03.DOMAIN.COM) > [edprjenslave03.DOMAIN.COM](http://edprjenslave03.DOMAIN.COM) | UNREACHABLE! =\> { > “changed”: false, > “msg”: “kerberos: (u’http’, u’Bad HTTP response returned from server. Code 500’), plaintext: the specified credentials were rejected by the server”, > “unreachable”: true > } At first it was just refusing without the kerberos part of the error. Realized I didn’t have Kerberos installed. Remedied that: > Ticket cache: FILE:/tmp/krb5cc\_1000 > Default principal: [afisher@DOMAIN.COM](mailto:afisher@DOMAIN.COM) > Valid starting Expires Service principal > 05/02/2017 09:23:47 05/02/2017 19:23:47 krbtgt/DOMAIN.COM@DOMAIN.COM > renew until 05/03/2017 09:23:41 > 05/02/2017 09:49:54 05/02/2017 19:23:47 HTTP/edprjenslave03.domain.com@ > renew until 05/03/2017 09:23:41 > 05/02/2017 09:49:54 05/02/2017 19:23:47 HTTP/edprjenslave03.domain.com@DOMAIN.COM > renew until 05/03/2017 09:23:41 Tried adding the user to the local administrators, no dice. Confirmed that I indeed do have the latest version of pywinrm installed: > afisher@ubuntu:~/Projects/build-utils/ansible-playbooks$ sudo -H pip install --upgrade pywinrm > Requirement already up-to-date: pywinrm in /usr/local/lib/python2.7/dist-packages > Requirement already up-to-date: xmltodict in /usr/local/lib/python2.7/dist-packages (from pywinrm) > Requirement already up-to-date: requests-ntlm\>=0.3.0 in /usr/local/lib/python2.7/dist-packages (from pywinrm) > Requirement already up-to-date: six in /usr/lib/python2.7/dist-packages (from pywinrm) > Requirement already up-to-date: requests\>=2.9.1 in /usr/local/lib/python2.7/dist-packages (from pywinrm) > Requirement already up-to-date: ntlm-auth\>=1.0.2 in /usr/local/lib/python2.7/dist-packages (from requests-ntlm\>=0.3.0-\>pywinrm) Here’s my inventory file: > * * * > > [windows] > [edprjenslave03.DOMAIN.COM](http://edprjenslave03.DOMAIN.COM) Here’s my group\_vars/windows.yml > * * * > > ansible\_user: [afisher@DOMAIN.COM](mailto:afisher@DOMAIN.COM) > ansible\_password: the\_pass > ansible\_port: 5985 > ansible\_connection: winrm > ansible\_winrm\_cert\_validation: ignore Any ideas? I’m starting to run out of tricks. Thanks! Allen ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [May 2, 2017, 9:09pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/2 "2017-05-02T21:09:23Z")
WinRM is an annoying mechanism with very unhelpful error messages so this could potentially be a few things that could be causing your issue. The first thing is that pywinrm doesn't play nice wth HTTP end points unless you disable the majority of the security configurations like AllowUnencrypted=true so try and setup a HTTPS endpoint and use that. The script here [https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1](https://github.com/ansible/ansible/blob/devel/examples/scripts/ConfigureRemotingForAnsible.ps1) will set one up for you with a self signed certificate which is good to use for testing. There are some particular WinRM auth settings that are not fully supported as welll currently like CbtHardeningLevel set to strict with Kerberos. If you run "winrm get winrm/config/service/auth" you can see what level it is currently set at. You can also see if Kerberos auth is actually enabled. If your workplace mandates this need to be set to Strict for security purposes your only options would be to use NTLM or CredSSP which currently supports CBT. Have a go with these 2 thing ad let us know if you still have any issues. ---
**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\ **Post date:** [May 2, 2017, 9:18pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/3 "2017-05-02T21:18:33Z")
Id suggest switching to port 5986 which is the https winrm listener port too. If you have run the configure for remoting script successfully that should work. Also, use ansible 2.3 as it has built in support for acquiring Kerberos (active directory) tickets. You still need to configure your krb5.conf and install the Kerberos libs as listed in the wndows setup documentation of course. Hole this helps, Jon ---
**Author:** ![Allen\_Fisher1](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@Allen\_Fisher1](https://forum.ansible.com/u/Allen_Fisher1)\ **Post date:** [May 4, 2017, 1:06pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/4 "2017-05-04T13:06:28Z")
Thanks Jordan and J. I switched to the local administrator account. I also re-ran the ConfigureRemotingForAnsible script. Now I get the dreaded “the specified credentials were rejected by the server” error > PS C:\Users\afisher\Documents\> C:\Users\afisher\Documents\ConfigureRemotingForAnsible.ps1 -Verbose > VERBOSE: Verifying WinRM service. > VERBOSE: PS Remoting is already enabled. > VERBOSE: SSL listener is already active. > VERBOSE: Basic auth is already enabled. > VERBOSE: Firewall rule already exists to allow WinRM HTTPS. > VERBOSE: HTTP: Enabled | HTTPS: Enabled > VERBOSE: PS Remoting has been successfully configured for Ansible. I’ve tried both ports… ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [May 4, 2017, 1:43pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/5 "2017-05-04T13:43:30Z")
Can you post the results of “winrm get winrm/config/service” here to show us your WinRM configuration. ---
**Author:** ![Allen\_Fisher1](https://avatars.discourse-cdn.com/v4/letter/a/ebca7d/32.png) [@Allen\_Fisher1](https://forum.ansible.com/u/Allen_Fisher1)\ **Post date:** [May 4, 2017, 2:38pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/6 "2017-05-04T14:38:22Z")
Sure thing: ---
**Author:** ![cupcake](https://avatars.discourse-cdn.com/v4/letter/c/d6d6ee/32.png) [@cupcake](https://forum.ansible.com/u/cupcake)\ **Post date:** [May 4, 2017, 7:33pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/7 "2017-05-04T19:33:55Z")
allow unencrypted: `winrm set winrm/config/service '@{AllowUnencrypted="true"}'` ---
**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\ **Post date:** [May 4, 2017, 8:51pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/8 "2017-05-04T20:51:28Z")
I would only allow unencrypted messages for testing and debugging purposes and never in any production capacity due to the security risk when running over HTTP. Useful in this case to see if the HTTP endpoint works but should be turned back off eventually. Some other things to try - use a real powershell host and connect with those credentials, will verify if the account is valid and has enough permissions - use pywinrm direct and manually get a Kerberos ticket using kinit, will see if Ansible is getting the tickets correctly - try using NTLM as a test instead, will see if the problem is in the Kerberos auth somewhere - scan the Windows security event logs and try and find the reason it is rejecting each request ---
**Author:** ![Kamran\_Ayub](https://avatars.discourse-cdn.com/v4/letter/k/439d5e/32.png) [@Kamran\_Ayub](https://forum.ansible.com/u/Kamran_Ayub)\ **Post date:** [May 24, 2017, 7:23pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/9 "2017-05-24T19:23:40Z")
Just got done configuring some Windows hosts with Ansible Tower. - Use port 5986 because AllowUnencrypted=False will prevent 5985 from working (for good reason!) w/ Kerberos - Use a certificate on 5986, I noticed your CertThumbprint is missing - Ensure 5986 firewall port is open - Test connecting via Powershell (Invoke-Command -ComputerName blah -Credential username -Authentication Kerberos -UseSSL -Port 5986 { echo ‘Hello World’ }) You can run the ConfigureRemotingForAnsible.ps1 script to do this all for you and test the connection. I actually made some PRs to it this week to enhance it. Since your machine is domain-joined, I recommend using the machine certificate that gets provisioned (not required). My PR contribution adds this to the ansible remoting script, but you can modify the existing script to do it. ---
**Author:** ![ashokkumarbulago](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@ashokkumarbulago](https://forum.ansible.com/u/ashokkumarbulago)\ **Post date:** [October 26, 2017, 7:03pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/10 "2017-10-26T19:03:23Z")
resolved the above error by uncommenting the line " 127.0.0.1 localhost " in C:\Windows\System32\drivers\etc\hosts file, then it works ---
**Author:** ![ashokkumarbulago](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@ashokkumarbulago](https://forum.ansible.com/u/ashokkumarbulago)\ **Post date:** [October 26, 2017, 7:03pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/11 "2017-10-26T19:03:36Z")
resolved the above error by uncommenting the line " 127.0.0.1 localhost " in C:\Windows\System32\drivers\etc\hosts file, then it works ---
**Author:** ![ashokkumarbulago](https://avatars.discourse-cdn.com/v4/letter/a/b5ac83/32.png) [@ashokkumarbulago](https://forum.ansible.com/u/ashokkumarbulago)\ **Post date:** [October 26, 2017, 7:04pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/12 "2017-10-26T19:04:07Z")
resolved the above error by uncommenting the line " 127.0.0.1 localhost " in C:\Windows\System32\drivers\etc\hosts file, then it works ---
**Author:** ![sateeshazure](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@sateeshazure](https://forum.ansible.com/u/sateeshazure)\ **Post date:** [December 3, 2018, 12:16am UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/13 "2018-12-03T00:16:03Z")
Hi, I am getting following error when i am trying to run a playbook to config a windows machine, Msg: basic: Bad HTTP response returned from server . code 404. actually the error getting at gathering facts: i have given my windows host name ---
**Author:** ![sateeshazure](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@sateeshazure](https://forum.ansible.com/u/sateeshazure)\ **Post date:** [December 3, 2018, 12:27am UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/14 "2018-12-03T00:27:07Z")
hi, [webserver] [ssk.ms.com](http://ssk.ms.com) [webserver:vars] ansible\_user=windows ansible\_password=PWD ansible\_connection=winrm ansible\_winrm\_transport=basic ansible\_winrm\_scheme=http ansible\_port=5985 #ansible\_winrm\_operation\_timeout\_sec=60 #ansible\_winrm\_read\_timeout\_sec=70 ansible\_winrm\_server\_cert\_validation=ignore this is my inventory file, when i run my main.yml file is ---
**Author:** ![Narmada\_Karthika](https://avatars.discourse-cdn.com/v4/letter/n/b5e925/32.png) [@Narmada\_Karthika](https://forum.ansible.com/u/Narmada_Karthika)\ **Post date:** [December 3, 2018, 5:58pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/15 "2018-12-03T17:58:20Z")
Use Kerbors it works. ---
**Author:** ![sateeshazure](https://avatars.discourse-cdn.com/v4/letter/s/b782af/32.png) [@sateeshazure](https://forum.ansible.com/u/sateeshazure)\ **Post date:** [December 3, 2018, 8:47pm UTC](https://forum.ansible.com/t/kerberos-uhttp-ubad-http-response-returned-from-server-code-500-plaintext-the-specified-credentials-were-rejected-by-the-server/24378/16 "2018-12-03T20:47:10Z")
I tried with Kerberos I am getting error Msg: Kerberos: requested with method is jerboas, but request- kerbose is not installed I tried to run cmd pip install request-kerberos But firewall restricting Is there any other way Thanks