# Unspecified GSS failure

**URL:** <https://forum.ansible.com/t/unspecified-gss-failure/19457>\
**Category:** Ansible Project\
**Tags:** ubuntu\
**Created:** [October 7, 2015, 2:27pm UTC](https://forum.ansible.com/t/unspecified-gss-failure/19457 "2015-10-07T14:27:51Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Trond\_Hindenes](https://avatars.discourse-cdn.com/v4/letter/t/96bed5/32.png) [@Trond\_Hindenes](https://forum.ansible.com/u/Trond_Hindenes)\
**Post date:** [October 7, 2015, 2:27pm UTC](https://forum.ansible.com/t/unspecified-gss-failure/19457/1 "2015-10-07T14:27:51Z")

</div>

Hi all,  
I’m getting a new error I’ve never seen before. Control node is Centos7. When trying to use a domain account I’m getting this error when running ansible:

MSC10051.domain.local | FAILED =\> Traceback (most recent call last):  
File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 582, in \_executor  
exec\_rc = self.\_executor\_internal(host, new\_stdin)  
File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 785, in \_executor\_internal  
return self.\_executor\_internal\_inner(host, self.module\_name, self.module\_args, inject, port, complex\_args=complex\_args)  
File “/usr/lib/python2.7/site-packages/ansible/runner/ **init**.py”, line 964, in \_executor\_internal\_inner  
conn = self.connector.connect(actual\_host, actual\_port, actual\_user, actual\_pass, actual\_transport, actual\_private\_key\_file, delegate\_host)  
File “/usr/lib/python2.7/site-packages/ansible/runner/connection.py”, line 52, in connect  
self.active = conn.connect()  
File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 140, in connect  
self.protocol = self.\_winrm\_connect()  
File “/usr/lib/python2.7/site-packages/ansible/runner/connection\_plugins/winrm.py”, line 96, in \_winrm\_connect  
protocol.send\_message(‘’)  
File “/usr/lib/python2.7/site-packages/winrm/protocol.py”, line 190, in send\_message  
return self.transport.send\_message(message)  
File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 219, in send\_message  
krb\_ticket = KerberosTicket(self.krb\_service)  
File “/usr/lib/python2.7/site-packages/winrm/transport.py”, line 166, in **init**  
kerberos.authGSSClientStep(krb\_context, ‘’)  
GSSError: ((‘Unspecified GSS failure. Minor code may provide more information’, 851968), (‘KDC reply did not match expectations’, -1765328237))

I’ve setup kerberos with Ansible lots of times before, but only on Ubuntu. kinit/klist looks fine, so I’m struggling with how to figure this one out. Any pointers appreciated! Installed Ansible using yum, version 1.9.2

---

<div class="post-metadata">

**Author:** ![Bill\_Nottingham](https://avatars.discourse-cdn.com/v4/letter/b/3e96dc/32.png) [@Bill\_Nottingham](https://forum.ansible.com/u/Bill_Nottingham)\
**Post date:** [October 7, 2015, 2:46pm UTC](https://forum.ansible.com/t/unspecified-gss-failure/19457/2 "2015-10-07T14:46:37Z")

</div>

Some googling suggests it could mean a case mismatch in the kerberos principal name, if using an AD server, or disagreements about the renewable lifetime of the ticket.

Bill

---

<div class="post-metadata">

**Author:** ![j.r.hawkesworth](https://avatars.discourse-cdn.com/v4/letter/j/a3d4f5/32.png) [@j.r.hawkesworth](https://forum.ansible.com/u/j.r.hawkesworth)\
**Post date:** [October 7, 2015, 8:15pm UTC](https://forum.ansible.com/t/unspecified-gss-failure/19457/3 "2015-10-07T20:15:26Z")

</div>

Hi,

I think I’ve had this before where the name I had for the domain turned out to be an alias.

If you run kinit -C user@SOME.DOMAIN  
and then do a klist  
if the ticket you get back is not for SOME.DOMAIN then that’s the issue.

I just changed my config so I was requesting a ticket for the actual domain, but it might be possible to tweak your /etc/krb5.conf to get round this.

Hope this helps,

Jon