If you want to use Kerberos then yes you need to be able to contact the DC. That's part of the Kerberos protocol and nothing can change that.
On Friday, October 30, 2020 at 9:19:39 AM UTC+10 [email protected] wrote: > I have a ansible control box and have configured it to manage windows > servers. > Using NTLM it seems to work fine and can join servers to the domain and > also can change local group membership, all using NTLM, but my group_vars > file contains the domain account and password to join to the domain. > > If I move away from NTLM auth and rely solely on kerberos, I have > configured my /etc/krb5.conf file with domain details and DC. > > When I try to do a basic test using win_ping, I get the below > > "msg": "Kerberos auth failure for principal [email protected] with > subprocess: kinit: Cannot contact any KDC for realm 'domain.local' while > getting initial credentials", > "unreachable": true > > So my question is > > I am wondering if my ansible box is trying to auth against the DC. As I > thought it would pass the creds to the windows box and have it auth off the > DC. > > -- You received this message because you are subscribed to the Google Groups "Ansible Project" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/ansible-project/c2d58764-29f9-4710-9286-c8baea1884e3n%40googlegroups.com.
