# NTLM Delegation

**URL:** <https://forum.ansible.com/t/ntlm-delegation/22039>\
**Category:** Ansible Project\
**Created:** [July 18, 2016, 9:19am UTC](https://forum.ansible.com/t/ntlm-delegation/22039 "2016-07-18T09:19:35Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Karol\_Olczak](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@Karol\_Olczak](https://forum.ansible.com/u/Karol_Olczak)\
**Post date:** [July 18, 2016, 9:19am UTC](https://forum.ansible.com/t/ntlm-delegation/22039/1 "2016-07-18T09:19:35Z")

</div>

Does Ansible 2.1 and pywinrm 0.2.p support NTLM delegation or only kerberos delegation ?  
If not, when can we expect to implement NTLM delegation functionality ?

Regards  
Karol

---

<div class="post-metadata">

**Author:** ![Shaps](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shaps/32/1356_2.png) [@Shaps](https://forum.ansible.com/u/Shaps)\
**Post date:** [July 18, 2016, 9:22am UTC](https://forum.ansible.com/t/ntlm-delegation/22039/2 "2016-07-18T09:22:53Z")

</div>

Hi Karol,

Yes, with pywinrm 0.2 you can use NTLM to connect to your windows hosts. Just as a side note this doesn’t have a lot to do with ansibile itself as it will only use whatever method pywinrm supports. To have NTLM support you should follow the pywinrm docs ( If I’m not wrong the only key package should be requests[Kerberos] ).

---

<div class="post-metadata">

**Author:** ![Karol\_Olczak](https://avatars.discourse-cdn.com/v4/letter/k/958977/32.png) [@Karol\_Olczak](https://forum.ansible.com/u/Karol_Olczak)\
**Post date:** [July 18, 2016, 9:49am UTC](https://forum.ansible.com/t/ntlm-delegation/22039/3 "2016-07-18T09:49:52Z")

</div>

I am afraid there is only kerberos delegation support ...

---

<div class="post-metadata">

**Author:** ![Shaps](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shaps/32/1356_2.png) [@Shaps](https://forum.ansible.com/u/Shaps)\
**Post date:** [July 18, 2016, 10:00am UTC](https://forum.ansible.com/t/ntlm-delegation/22039/4 "2016-07-18T10:00:32Z")

</div>

I am definitely using NTLM for my windows hosts. I have the following packages installed:  
Requests 2.10.0  
Requests-kerberos 0.10.0  
Requests-ntlm 0.3.0  
Pywinrm 0.2.0

Just make sure you set “ansible\_winrm\_transport: ntlm” set in your vars.  
You should also set your remote\_user in the “DOMAIN\USER” form, if you use “user@domain” it should use Kerberos anyway.

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [July 19, 2016, 9:01am UTC](https://forum.ansible.com/t/ntlm-delegation/22039/5 "2016-07-19T09:01:21Z")

</div>

Just to clarify, delegation here means the ability to pass logged in credentials along to the remote host so that you can have the same rights and permssions on the remote host. This lets you do things like use remote shares in your playbooks.

You can use NTLM with pywinrm 0.2.0 but I believe the credentials will only allow you ‘single hop’ access to a remote machine. You can’t then use resources on other windows machines from the one you are controlling remotely without delegation, and its my understanding that is only available via kerberos right now.  
Jon

---

<div class="post-metadata">

**Author:** ![Matt\_Davis](https://avatars.discourse-cdn.com/v4/letter/m/ce7236/32.png) [@Matt\_Davis](https://forum.ansible.com/u/Matt_Davis)\
**Post date:** [July 21, 2016, 6:48pm UTC](https://forum.ansible.com/t/ntlm-delegation/22039/6 "2016-07-21T18:48:00Z")

</div>

I don’t believe NTLM credential delegation is supported by WinRM (I’ve not been able to find anything about it), which means by definition it wouldn’t be supported by Ansible either.

That said, I’ve been experimenting with various mechanisms for become support on Windows (soft target for Ansible 2.3), most of which would get you effectively the same behavior.