# SharePointDSC parameter PsDscRunAsCredential with Kerberos

**URL:** <https://forum.ansible.com/t/sharepointdsc-parameter-psdscrunascredential-with-kerberos/32982>\
**Category:** Ansible Project\
**Created:** [May 20, 2020, 8:33am UTC](https://forum.ansible.com/t/sharepointdsc-parameter-psdscrunascredential-with-kerberos/32982 "2020-05-20T08:33:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![jn.bedag](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jn.bedag](https://forum.ansible.com/u/jn.bedag)\
**Post date:** [May 20, 2020, 8:33am UTC](https://forum.ansible.com/t/sharepointdsc-parameter-psdscrunascredential-with-kerberos/32982/1 "2020-05-20T08:33:15Z")

</div>

Hi

According to the documentation, for SharePointDCS modules to work, we have to specify PsDscRunAsCredentials in win\_dcs module:

- name: set shell admin for farmaccount  
win\_dsc:  
resource\_name: SPShellAdmins  
IsSingleInstance: “Yes”  
MembersToInclude: “farmadmin\_user”  
AllDatabases: true  
PsDscRunAsCredential\_username: ‘{{ ansible\_user }}’  
PsDscRunAsCredential\_password: ‘{{ ansible\_password }}’

But we’re running ansible with a kerberos configuration with our personal serveradmin user:  
ansible\_user=“@domain.local”  
ansible\_connection=winrm  
ansible\_winrm\_transport=kerberos  
ansible\_winrm\_kerberos\_delegation=true

Therefore ansible\_password does not work.

And we can’t specify a seperate user, because this user would have to be member of the SPShellAdmins, which is not possible because we can’t specify a seperate user 😉  
Omitting these parameters does not work either.  
So we must be able to run the module with the personal serveradmin account, only this account is member of the SPShellAdmins at this moment.

Is there a way to tell PsDscRunAsCredentials somehow to take the kerberos credentials?  
Or is there another approach for this?

Thank you very much

---

<div class="post-metadata">

**Author:** ![jborean](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jborean/32/1525_2.png) [@jborean](https://forum.ansible.com/u/jborean)\
**Post date:** [May 20, 2020, 7:35pm UTC](https://forum.ansible.com/t/sharepointdsc-parameter-psdscrunascredential-with-kerberos/32982/2 "2020-05-20T19:35:45Z")

</div>

Unfortunately no, the DSC engine requires explicit username and password and cannot be configured to run using an existing access token. It is probably needed because the DSC engine runs each task as the SYSTEM account so any network authentication will appear as it came from the AD computer account. By setting explicit PSDSCRunAsCredential you tell the engine to use those credentials instead.