# 'No Kerberos credentials available' when executing tasks from a server that is not joined to AD. **URL:** \ **Category:** Ansible Project\ **Tags:** windows\ **Created:** [June 7, 2016, 11:51am UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686 "2016-06-07T11:51:25Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Willem\_Bos](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@Willem\_Bos](https://forum.ansible.com/u/Willem_Bos)\ **Post date:** [June 7, 2016, 11:51am UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/1 "2016-06-07T11:51:25Z")
Hi all, I’m trying to use winrm to execute tasks on a windows server (after following the steps in [http://docs.ansible.com/ansible/intro\_windows.html](http://docs.ansible.com/ansible/intro_windows.html)). As a test I use the win\_ping module. This works only when a Kerberos ticket present beforehand. Is it a requirement to have the Linux server be member of the AD infrastructure? If so, then the only way to make this work from a controle machine - without joining the domain - would be to run a kinit from my playbook first, right? I found several similar cases but none mention if AD membership is a ‘hard’ requirement. **\*\* INFO \*\*** rpm -qa | grep -E “ansible|python-devel|krb5-devel|krb5-libs|krb5-workstation|python-kerberos” | sort ansible-2.0.2.0-1.el7.noarch krb5-devel-1.13.2-12.el7\_2.x86\_64 krb5-libs-1.13.2-12.el7\_2.x86\_64 krb5-workstation-1.13.2-12.el7\_2.x86\_64 python-devel-2.7.5-34.el7.x86\_64 python-kerberos-1.1-15.el7.x86\_64 pip list | grep winrm pywinrm (0.1.1) **\*\* WORKS \*\*** kinit domain-user@AD-DOMAIN … klist Ticket cache: KEYRING:persistent:0:0 Default principal: domain-user@AD-DOMAIN Valid starting Expires Service principal 06/07/2016 11:26:20 06/07/2016 21:26:20 krbtgt/AD-DOMAIN@AD-DOMAIN renew until 06/14/2016 11:26:20 ansible -m win\_ping windows-server.ad-domain windows-server.ad-domain | SUCCESS =\> { “changed”: false, “ping”: “pong” } **\*\* DOESN’T WORK \*\*** kdestroy -A ansible -m win\_ping windows-server.ad-domain -vvvvv Using /etc/ansible/ansible.cfg as config file Loaded callback minimal of type stdout, v2.0 \ ESTABLISH WINRM CONNECTION FOR USER: domain-user@AD-DOMAIN on PORT 5986 TO windows-server.ad-domain \ WINRM CONNECT: transport=kerberos endpoint=[https://windows-server.ad-domain:5986/wsman](https://windows-server.ad-domain:5986/wsman) \ WINRM CONNECTION ERROR: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243)) Traceback (most recent call last): File “/usr/lib/python2.7/site-packages/ansible/plugins/connection/winrm.py”, line 134, in \_winrm\_connect protocol.send\_message(‘’) File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 193, in send\_message return self.transport.send\_message(message) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 269, in send\_message krb\_ticket = KerberosTicket(self.krb\_service) File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 205, in **init** kerberos.authGSSClientStep(krb\_context, ‘’) GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243)) windows-server.ad-domain | FAILED! =\> { “failed”: true, “msg”: “kerberos: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘No Kerberos credentials available’, -1765328243))” } Regards, Willem ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [June 7, 2016, 12:02pm UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/2 "2016-06-07T12:02:58Z")
Hi Willem, this is (for now) by design. Matt is working on (or at least planning to work on) automatically invoking kinit behind the scenes to automatically get a Kerberos ticket if needed, but for now, that has to be present. You could probably use a local\_action to make sure one exists on the control node before executing the windows part of your playbook. ---
**Author:** ![Willem\_Bos](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@Willem\_Bos](https://forum.ansible.com/u/Willem_Bos)\ **Post date:** [June 7, 2016, 12:27pm UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/3 "2016-06-07T12:27:05Z")
Hi Trond, Thanks for the confirmation. So, as it is already planned I take it there’s no need to file a feature request? Regards, Willem. ---
**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\ **Post date:** [June 7, 2016, 2:42pm UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/4 "2016-06-07T14:42:36Z")
Hi, Nope, that’s work in progress afaik. ---
**Author:** ![Willem\_Bos](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@Willem\_Bos](https://forum.ansible.com/u/Willem_Bos)\ **Post date:** [June 7, 2016, 3:59pm UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/5 "2016-06-07T15:59:49Z")
For people running into the same problem, this is (more or less) the playbook I use : - hosts: all tasks: - name: Install prerequisite software (using yum) yum: enablerepo: epel update\_cache: yes name: “{{ item }}” state: present with\_items: - python-pip - python-ptyprocess delegate\_to: localhost - name: Uninstall old pexpect package (using yum) yum: name: pexpect state: absent delegate\_to: localhost - name: Install prerequisite software (using pip) pip: name: pexpect version: 3.3 state: present delegate\_to: localhost - name: Check for precense of Kerberos ticket command: /usr/bin/klist register: klist\_result changed\_when: no ignore\_errors: yes delegate\_to: localhost - name: Request Kerberos ticket if none present expect: command: /usr/bin/kinit domain-user@AD-DOMAIN responses: ‘(?i)password’: domain-user-password changed\_when: no when: klist\_result.rc != 0 delegate\_to: localhost The first task installs prerequisite software for the expect module using rpm’s from [EPEL](https://fedoraproject.org/wiki/EPEL). The version of pexpect (another prerequisite) that the Red Hat and CentOS rpm’s provide is too old for Ansible, so we uninstall this in the second task. The third task installs the required version of pexpect using pip. The third and fourth tasks actually deal with requesting a Kerberos ticket granting ticket when it is not present. Regards,Willem. ---
**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\ **Post date:** [June 7, 2016, 5:31pm UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/6 "2016-06-07T17:31:23Z")
Depending on what you’re doing, NTLM might be a better fit for you (install pywinrm\>=0.2.0, set ansible\_winrm\_transport=ntlm and specify ansible\_user/ansible\_password). Automatic ticket management in pywinrm/our connection plugin is definitely on my list of “things I wish we could do”, but it’s tentatively slated for 2.3 (2 releases out). Docs are forthcoming for all that stuff- I wanted to wait until the new pywinrm bits were actually released before publishing doc updates on NTLM; they released a couple days ago. ---
**Author:** ![Willem\_Bos](https://avatars.discourse-cdn.com/v4/letter/w/bcef8e/32.png) [@Willem\_Bos](https://forum.ansible.com/u/Willem_Bos)\ **Post date:** [June 8, 2016, 6:35am UTC](https://forum.ansible.com/t/no-kerberos-credentials-available-when-executing-tasks-from-a-server-that-is-not-joined-to-ad/21686/7 "2016-06-08T06:35:25Z")
Just tried pywinrm 0.2rc6. Both ansible\_winrm\_transport=ntlm and ansible\_winrm\_transport=kerberos work fine. Thanks!