# Need some help using Kerberos Authentication for Windows Target

**URL:** <https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313>\
**Category:** Ansible Project\
**Tags:** windows\
**Created:** [August 10, 2018, 8:01pm UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313 "2018-08-10T20:01:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![callmeshawn](https://avatars.discourse-cdn.com/v4/letter/c/cab0a1/32.png) [@callmeshawn](https://forum.ansible.com/u/callmeshawn)\
**Post date:** [August 10, 2018, 8:01pm UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313/1 "2018-08-10T20:01:46Z")

</div>

Hello,

I’ve configured a Windows 2016 Server using ConfigureRemotingForAnsible.ps1 and am able to do a simple ping test using basic auth.

Command I’m using is:  
ansible all -i myinventory -m win\_ping

I get a pong back.

When trying to use Kerberos, authentication … different story:  
My inventory looks like:  
[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com) [ansible\_user=networkaccount@CSXT.AD.CSX.COM](mailto:ansible_user=networkaccount@CSXT.AD.CSX.COM) ansible\_password=secret ansible\_port=5986 ansible\_winrm\_transport=kerberos ansible\_connection=winrm ansible\_winrm\_server\_cert\_validation=ignore

Instead, I’m seeing:

ansible all -i kerbauth -m win\_ping  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg force\_preemptive, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg delegate, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg send\_cbt, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg principal, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg sanitize\_mutual\_error\_response, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg hostname\_override, check installed version with pip list  
% (str(function), name))  
An exception occurred during task execution. To see the full traceback, use -vvv. The error was: MutualAuthenticationError: Unable to authenticate \<Response [200]\>  
[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com) | FAILED! =\> {  
“msg”: “Unexpected failure during module execution.”,  
“stdout”: “”  
}

For more verbose:

[j8683@lnx30137 /home/j8683]$ ansible all -i kerbauth -m win\_ping -vvvvv  
ansible 2.6.2  
config file = /etc/ansible/ansible.cfg  
configured module search path = [u’/home/j8683/.ansible/plugins/modules’, u’/usr/share/ansible/plugins/modules’]  
ansible python module location = /usr/lib/python2.7/site-packages/ansible  
executable location = /usr/bin/ansible  
python version = 2.7.5 (default, May 3 2017, 07:55:04) [GCC 4.8.5 20150623 (Red Hat 4.8.5-14)]  
Using /etc/ansible/ansible.cfg as config file  
setting up inventory plugins  
Parsed /home/j8683/kerbauth inventory source with ini plugin  
Loading callback plugin minimal of type stdout, v2.0 from /usr/lib/python2.7/site-packages/ansible/plugins/callback/minimal.pyc  
META: ran handlers  
Using module file /usr/lib/python2.7/site-packages/ansible/modules/windows/win\_ping.ps1  
\<[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com)\> ESTABLISH WINRM CONNECTION FOR USER: [networkaccount@CSXT.AD.CSX.COM](mailto:networkaccount@CSXT.AD.CSX.COM) on PORT 5986 TO [xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com)  
checking if winrm\_host [xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com) is an IPv6 address  
creating Kerberos CC at /tmp/tmp8tVXsJ  
calling kinit with subprocess for principal [networkaccount@CSXT.AD.CSX.COM](mailto:networkaccount@CSXT.AD.CSX.COM)  
kinit succeeded for principal [networkaccount@CSXT.AD.CSX.COM](mailto:networkaccount@CSXT.AD.CSX.COM)  
\<[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com)\> WINRM CONNECT: transport=kerberos endpoint=[https://xjaxd11133app.csxt.ad.csx.com:5986/wsman](https://xjaxd11133app.csxt.ad.csx.com:5986/wsman)  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg force\_preemptive, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg delegate, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg send\_cbt, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg principal, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg sanitize\_mutual\_error\_response, check installed version with pip list  
% (str(function), name))  
/usr/lib/python2.7/site-packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg hostname\_override, check installed version with pip list  
% (str(function), name))  
\<[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com)\> WINRM OPEN SHELL: 175244FF-08BF-4463-A577-1B800748F4B5  
EXEC (via pipeline wrapper)  
\<[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com)\> WINRM EXEC ‘PowerShell’ [‘-NoProfile’, ‘-NonInteractive’, ‘-ExecutionPolicy’, ‘Unrestricted’, ‘-’]  
\<[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com)\> WINRM CLOSE SHELL: 175244FF-08BF-4463-A577-1B800748F4B5  
The full traceback is:  
Traceback (most recent call last):  
File “/usr/lib/python2.7/site-packages/ansible/executor/task\_executor.py”, line 138, in run  
res = self.\_execute()  
File “/usr/lib/python2.7/site-packages/ansible/executor/task\_executor.py”, line 576, in \_execute  
result = self.\_handler.run(task\_vars=variables)  
File “/usr/lib/python2.7/site-packages/ansible/plugins/action/normal.py”, line 46, in run  
result = merge\_hash(result, self.\_execute\_module(task\_vars=task\_vars, wrap\_async=wrap\_async))  
File “/usr/lib/python2.7/site-packages/ansible/plugins/action/ **init**.py”, line 853, in \_execute\_module  
res = self.\_low\_level\_execute\_command(cmd, sudoable=sudoable, in\_data=in\_data)  
File “/usr/lib/python2.7/site-packages/ansible/plugins/action/ **init**.py”, line 960, in \_low\_level\_execute\_command  
rc, stdout, stderr = self.\_connection.exec\_command(cmd, in\_data=in\_data, sudoable=sudoable)  
File “/usr/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py”, line 524, in exec\_command  
result = self.\_winrm\_exec(cmd\_parts[0], cmd\_parts[1:], from\_exec=True, stdin\_iterator=stdin\_iterator)  
File “/usr/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py”, line 433, in \_winrm\_exec  
command\_id = self.protocol.run\_command(self.shell\_id, to\_bytes(command), map(to\_bytes, args), console\_mode\_stdin=(stdin\_iterator is None))  
File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 341, in run\_command  
res = self.send\_message(xmltodict.unparse(req))  
File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 234, in send\_message  
resp = self.transport.send\_message(message)  
File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 256, in send\_message  
response = self.\_send\_message\_request(prepared\_request, message)  
File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 261, in \_send\_message\_request  
response = self.session.send(prepared\_request, timeout=self.read\_timeout\_sec)  
File “/usr/lib/python2.7/site-packages/requests/sessions.py”, line 582, in send  
r = dispatch\_hook(‘response’, hooks, r, \*\*kwargs)  
File “/usr/lib/python2.7/site-packages/requests/hooks.py”, line 41, in dispatch\_hook  
_hook\_data = hook(hook\_data, \*\*kwargs)  
File "/usr/lib/python2.7/site-packages/requests\_kerberos/kerberos_.py", line 267, in handle\_response  
_r = self.handle\_other(response)  
File "/usr/lib/python2.7/site-packages/requests\_kerberos/kerberos_.py", line 212, in handle\_other  
“{0}”.format(response))  
MutualAuthenticationError: Unable to authenticate \<Response [200]\>

[xjaxd11133app.csxt.ad.csx.com](http://xjaxd11133app.csxt.ad.csx.com) | FAILED! =\> {  
“msg”: “Unexpected failure during module execution.”,  
“stdout”: “”  
}

I’ve got the following winrm, requests, and kerberos software installed…

pip list | grep -e winrm -e kerb  
kerberos 1.3.0  
pykerberos 1.2.1  
pywinrm 0.3.0  
requests-kerberos 0.12.0

Has anyone seen this?

Thanks,

Radesh

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [August 12, 2018, 11:14am UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313/2 "2018-08-12T11:14:16Z")

</div>

I haven’t seen this error before myself.  
This line in your your errors makes it look to me like there is something unexpected about the underlying libs on your ansible controller.

/usr/lib/python2.7/site-  
packages/winrm/transport.py:299: UserWarning: Function does not contain optional arg force\_preemptive, check installed version with pip list

Sometimes things get scrambled when there is a mismatch between versions of libraries installed by your operating system package manager and the libraries that python expects.

In such cases sometimes you can fix things but uninstalling and reinstalling everything.

You don’t mention how you installed ansible but if its from pip I’d recommend upgrading pip itself to the latest version, then uninstalling and reinstalling ansible.

Hope this helps,

Jon

---

<div class="post-metadata">

**Author:** ![David\_Baumann](https://avatars.discourse-cdn.com/v4/letter/d/aca169/32.png) [@David\_Baumann](https://forum.ansible.com/u/David_Baumann)\
**Post date:** [August 12, 2018, 4:44pm UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313/3 "2018-08-12T16:44:36Z")

</div>

I thing the pykerberos module is missing

Check ansible docs

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 12, 2018, 11:26pm UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313/4 "2018-08-12T23:26:50Z")

</div>

While pip is showing the packages are installed it seems like they were not installed properly or something is wrong with your Python environment. It is showing various warnings saying various kwargs pywinrm expects from requests-kerberos are not there which shouldn’t be happening if you are on the latest version. The actual error you are getting seems to be a bug, it is getting a 200 response but is expecting the server to reply with a token so the client can authenticate the host and verify it is who it is saying it is.

I would recommend you create a virtualenv and install all the dependencies there to verify you are working with a clean environment. To do this you can run;

`  
virtualenv ansible-test  
source ansible-test/bin/activate  
pip install ansible pywinrm[kerberos]

ansible all -i kerbauth -m win\_ping -vvvvv  
`

Thanks

Jordan

---

<div class="post-metadata">

**Author:** ![callmeshawn](https://avatars.discourse-cdn.com/v4/letter/c/cab0a1/32.png) [@callmeshawn](https://forum.ansible.com/u/callmeshawn)\
**Post date:** [August 13, 2018, 7:51pm UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313/5 "2018-08-13T19:51:49Z")

</div>

Not sure of the original installation, but I’ve used yum to keep it updated.

I believe I’ve got version 18 of pip…

This is what I see when I check the version of pip…

pip -V  
pip 18.0 from /usr/lib/python2.7/site-packages/pip (python 2.7)

Would you suggest doing a pip install ansible over yum install ansible?

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [August 13, 2018, 10:46pm UTC](https://forum.ansible.com/t/need-some-help-using-kerberos-authentication-for-windows-target/28313/6 "2018-08-13T22:46:47Z")

</div>

I prefer using pip because system packages are system wide but I come from a developer focused background. Another reason why I’m not a fan of system packages is that they usually lag behind what is available in pip. There are definitely benefits to using system packages but it’s not for me.

When looking at the stracktrace we can see line 212 is in the handle\_other function whereas it is in another function on the v0.12.0 release [https://github.com/requests/requests-kerberos/blob/v0.12.0/requests\_kerberos/kerberos\_.py#L212](https://github.com/requests/requests-kerberos/blob/v0.12.0/requests_kerberos/kerberos_.py#L212). This tells me that an older (probably really old) version from the system package install is overriding whatever pip may have installed originally. To create a new environment not polluted by the system packages, please create a virtualenv with the following commands;

`  
virtualenv ansible-test  
source ansible-test/bin/activate  
pip install ansible pywinrm[kerberos]

ansible all -i kerbauth -m win\_ping -vvvvv

`

If this works then you know you need to look at the packages that are installed.

Thanks

Jordan