# kerberos

**URL:** <https://forum.ansible.com/t/kerberos/32945>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [May 15, 2020, 7:58pm UTC](https://forum.ansible.com/t/kerberos/32945 "2020-05-15T19:58:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [May 15, 2020, 7:58pm UTC](https://forum.ansible.com/t/kerberos/32945/1 "2020-05-15T19:58:37Z")

</div>

trying to get kerberos to work . I got all the libraries and krb5.conf file setup. I got a ticket from klist but when i do win\_ping

I get errors

ansible windows -i hosts -m win\_ping  
10.50.1.231 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”,  
“unreachable”: true  
}  
10.200.1.31 | UNREACHABLE! =\> {  
“changed”: false,  
“msg”: “kerberos: authGSSClientStep() failed: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘Server not found in Kerberos database’, -1765328377))”,  
“unreachable”: true  
}

my group\_vars file

ansible\_user: ‘svcs@DOMAIN.COM’  
ansible\_port: 5985  
ansible\_connection: ‘winrm’  
ansible\_winrm\_server\_cert\_validation: ‘ignore’  
ansible\_winrm\_transport: ‘kerberos’  
ansible\_become: false

any idea

---

<div class="post-metadata">

**Author:** ![Tony\_Wong](https://avatars.discourse-cdn.com/v4/letter/t/3ab097/32.png) [@Tony\_Wong](https://forum.ansible.com/u/Tony_Wong)\
**Post date:** [May 15, 2020, 8:33pm UTC](https://forum.ansible.com/t/kerberos/32945/2 "2020-05-15T20:33:34Z")

</div>

ok I got kerberos working now. but only via port 5986

why is that?

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [May 15, 2020, 9:46pm UTC](https://forum.ansible.com/t/kerberos/32945/3 "2020-05-15T21:46:55Z")

</div>

Kerberos is highly dependent on DNS from working. With Kerberos the client builds an SPN in the format 'HTTP/, in your case that will be ‘HTTP/10.50.1.231’. Active directory only creates automatic SPNs using the DNS name of a host, i.e. ‘HTTP/hostname.domain.com’ so that’s the SPN that needs to be specified by the Ansible client for Kerberos auth to work.

TLDR you can do on of the following in order of preference

- Connect to Ansible using the FQDN of the host and not the IP. This will construct the proper SPN
- Continue connecting using the IP but set ‘ansible\_winrm\_kerberos\_hostname\_override: ’
- Create the SPN in AD for ‘HTTP/’ for the host you are connecting to  
The first option is really the only sane way going forward as you don’t need to maintain 2 sets of data for the Windows host. If you have Kerberos set up correctly in your org then DNS should work just fine and you don’t have to worry about IP addresses at all.