# RE: \[ansible-devel\] Re: Kerberos domain authentication for Windows hosts

**URL:** <https://forum.ansible.com/t/re-ansible-devel-re-kerberos-domain-authentication-for-windows-hosts/16555>\
**Category:** Ansible Developer\
**Tags:** windows\
**Created:** [October 19, 2014, 11:10pm UTC](https://forum.ansible.com/t/re-ansible-devel-re-kerberos-domain-authentication-for-windows-hosts/16555 "2014-10-19T23:10:34Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nicolas\_Deslandes](https://avatars.discourse-cdn.com/v4/letter/n/e480ec/32.png) [@Nicolas\_Deslandes](https://forum.ansible.com/u/Nicolas_Deslandes)\
**Post date:** [October 19, 2014, 11:10pm UTC](https://forum.ansible.com/t/re-ansible-devel-re-kerberos-domain-authentication-for-windows-hosts/16555/1 "2014-10-19T23:10:34Z")

</div>

I agree, that’s a good point. You might very well want to use basic auth or NTLM to authenticate a domain user.  
So the ‘ansible\_authorization\_type’ parameter suggested by jhawkesworth would probably be a better way to select the auth mechanism.

Nico

---

<div class="post-metadata">

**Author:** ![Ian\_Clegg](https://avatars.discourse-cdn.com/v4/letter/i/6bbea6/32.png) [@Ian\_Clegg](https://forum.ansible.com/u/Ian_Clegg)\
**Post date:** [October 20, 2014, 7:41pm UTC](https://forum.ansible.com/t/re-ansible-devel-re-kerberos-domain-authentication-for-windows-hosts/16555/2 "2014-10-20T19:41:20Z")

</div>

Hey Nico,

I replied to Trod’s post, but basic auth doesnt work for domain users. If you step back, the form of the credentials dictates what mechanisms you can use. A UPN is the only case where you have a choice, but pywinrm does not support NTLM, so your stuck with keberos. However, I suspect that even if NTLM was available you would not need to choose - just send an SPNEGO token and add the NTLM mech oid and let the server decide on NTLM or Kerberos.

---

<div class="post-metadata">

**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\
**Post date:** [October 21, 2014, 12:00am UTC](https://forum.ansible.com/t/re-ansible-devel-re-kerberos-domain-authentication-for-windows-hosts/16555/3 "2014-10-21T00:00:40Z")

</div>

“but basic auth doesnt work for domain users” - I’ve never tested this but it should surely work? Do you have any documentation stating that it doesn’t?

---

<div class="post-metadata">

**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\
**Post date:** [October 21, 2014, 12:03am UTC](https://forum.ansible.com/t/re-ansible-devel-re-kerberos-domain-authentication-for-windows-hosts/16555/4 "2014-10-21T00:03:36Z")

</div>

Ian, I saw your reply in the other thread. Wow, this is news to me - thanks for digging up the info!