{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/14710","repository_url":"https://api.github.com/repos/ansible/ansible","labels_url":"https://api.github.com/repos/ansible/ansible/issues/14710/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/14710/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/14710/events","html_url":"https://github.com/ansible/ansible/issues/14710","id":137389360,"number":14710,"title":"Still seeing issues like: ssl: 500 WinRMTransport. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)","user":{"login":"Joeskyyy","id":4296375,"avatar_url":"https://avatars.githubusercontent.com/u/4296375?v=3","gravatar_id":"","url":"https://api.github.com/users/Joeskyyy","html_url":"https://github.com/Joeskyyy","followers_url":"https://api.github.com/users/Joeskyyy/followers","following_url":"https://api.github.com/users/Joeskyyy/following{/other_user}","gists_url":"https://api.github.com/users/Joeskyyy/gists{/gist_id}","starred_url":"https://api.github.com/users/Joeskyyy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Joeskyyy/subscriptions","organizations_url":"https://api.github.com/users/Joeskyyy/orgs","repos_url":"https://api.github.com/users/Joeskyyy/repos","events_url":"https://api.github.com/users/Joeskyyy/events{/privacy}","received_events_url":"https://api.github.com/users/Joeskyyy/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04"},{"url":"https://api.github.com/repos/ansible/ansible/labels/windows","name":"windows","color":"777777"}],"state":"closed","locked":false,"assignee":{"login":"nitzmahone","id":6775756,"avatar_url":"https://avatars.githubusercontent.com/u/6775756?v=3","gravatar_id":"","url":"https://api.github.com/users/nitzmahone","html_url":"https://github.com/nitzmahone","followers_url":"https://api.github.com/users/nitzmahone/followers","following_url":"https://api.github.com/users/nitzmahone/following{/other_user}","gists_url":"https://api.github.com/users/nitzmahone/gists{/gist_id}","starred_url":"https://api.github.com/users/nitzmahone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nitzmahone/subscriptions","organizations_url":"https://api.github.com/users/nitzmahone/orgs","repos_url":"https://api.github.com/users/nitzmahone/repos","events_url":"https://api.github.com/users/nitzmahone/events{/privacy}","received_events_url":"https://api.github.com/users/nitzmahone/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/ansible/ansible/milestones/5","html_url":"https://github.com/ansible/ansible/milestones/stable-2.0","labels_url":"https://api.github.com/repos/ansible/ansible/milestones/5/labels","id":975800,"number":5,"title":"stable-2.0","description":"","creator":{"login":"bcoca","id":836171,"avatar_url":"https://avatars.githubusercontent.com/u/836171?v=3","gravatar_id":"","url":"https://api.github.com/users/bcoca","html_url":"https://github.com/bcoca","followers_url":"https://api.github.com/users/bcoca/followers","following_url":"https://api.github.com/users/bcoca/following{/other_user}","gists_url":"https://api.github.com/users/bcoca/gists{/gist_id}","starred_url":"https://api.github.com/users/bcoca/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcoca/subscriptions","organizations_url":"https://api.github.com/users/bcoca/orgs","repos_url":"https://api.github.com/users/bcoca/repos","events_url":"https://api.github.com/users/bcoca/events{/privacy}","received_events_url":"https://api.github.com/users/bcoca/received_events","type":"User","site_admin":false},"open_issues":154,"closed_issues":929,"state":"open","created_at":"2015-02-11T19:43:06Z","updated_at":"2016-06-06T21:55:25Z","due_on":null,"closed_at":null},"comments":26,"created_at":"2016-02-29T21:56:12Z","updated_at":"2016-06-08T20:30:30Z","closed_at":"2016-03-01T23:15:06Z","body":"##### Issue Type:\r\n\r\n - Bug Report\r\n\r\n##### Ansible Version:\r\n\r\n```\r\nansible 2.0.1.0\r\n  config file =\r\n  configured module search path = Default w/o overrides\r\n```\r\n\r\n##### Ansible Configuration:\r\n\r\nSimple controller node talking to a windows machine (running all in EC2)\r\n\r\n##### Environment:\r\n\r\nController node: Amazon Linux 2015.09 with python 2.7.10\r\nManaged Node: Windows 2012 R2 Base with winrm installed and configured for HTTPS with self-signed certificate\r\n\r\nBoth nodes are joined to the domain and are within a security group that can communicate openly between the two (for debugging I've allowed all traffic between these nodes)\r\n\r\n##### Summary:\r\n\r\nFacing similar issues to https://github.com/ansible/ansible/issues/10294, but against a windows 2012 R2 machine from python 2.7.10. I'm able to connect and execute things from pywinrm, I'm able to authenticate against kerberos, and use the ticket in pywinrm, but no luck from ansible.\r\n\r\n##### Steps To Reproduce:\r\n\r\n```\r\n$ ansible tag_os_windows -m win_ping -e ansible_connection=winrm -e ansible_winrm_server_cert_validation=ignore -e ansible_user=admin@CORP.JENGEL.ME -vvvv\r\nNo config file found; using defaults\r\nLoaded callback minimal of type stdout, v2.0\r\n<172.31.1.164> ESTABLISH WINRM CONNECTION FOR USER: admin@CORP.JENGEL.ME on PORT 5986 TO 172.31.1.164\r\n172.31.1.164 | FAILED! => {\r\n    \"failed\": true,\r\n    \"msg\": \"kerberos: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377)), ssl: 500 WinRMTransport. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)\"\r\n}\r\n```\r\n\r\n##### Expected Results:\r\n\r\nI attempted a similar process with pywinrm directly:\r\n\r\n```\r\nfrom winrm.protocol import Protocol\r\n\r\np = Protocol(\r\n    endpoint='https://WIN-9LOSPRGSB3J.corp.jengel.me:5986/wsman',\r\n    transport='kerberos',\r\n    username='admin@CORP.JENGEL.ME',\r\n    server_cert_validation='ignore')\r\n\r\nshell_id = p.open_shell()\r\n\r\ncommand_id = p.run_command(shell_id, 'ipconfig')\r\n\r\nstd_out, std_err, status_code = p.get_command_output(shell_id, command_id)\r\n\r\nprint std_out\r\n```\r\n\r\nAnd was able to connect:\r\n\r\n```\r\n$ python kerb.py\r\n\r\nWindows IP Configuration\r\n\r\n\r\nEthernet adapter Ethernet:\r\n\r\n   Connection-specific DNS Suffix  . : corp.jengel.com\r\n   Link-local IPv6 Address . . . . . : fe80::6d85:63f9:f837:9e96%12\r\n   IPv4 Address. . . . . . . . . . . : 172.31.1.164\r\n   Subnet Mask . . . . . . . . . . . : 255.255.240.0\r\n   Default Gateway . . . . . . . . . : 172.31.0.1\r\n\r\nTunnel adapter isatap.ec2.internal:\r\n\r\n   Media State . . . . . . . . . . . : Media disconnected\r\n   Connection-specific DNS Suffix  . : corp.jengel.com\r\n```\r\n\r\n##### Actual Results:\r\n\r\nAnsible fails in the WinRMTransport with a certificate verification error.\r\n\r\n```\r\n$ ansible tag_os_windows -m win_ping -e ansible_connection=winrm -e ansible_winrm_server_cert_validation=ignore -e ansible_user=admin@CORP.JENGEL.ME -vvvv\r\nNo config file found; using defaults\r\nLoaded callback minimal of type stdout, v2.0\r\n<172.31.1.164> ESTABLISH WINRM CONNECTION FOR USER: admin@CORP.JENGEL.ME on PORT 5986 TO 172.31.1.164\r\n172.31.1.164 | FAILED! => {\r\n    \"failed\": true,\r\n    \"msg\": \"kerberos: (('Unspecified GSS failure.  Minor code may provide more information', 851968), ('Server not found in Kerberos database', -1765328377)), ssl: 500 WinRMTransport. [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)\"\r\n}\r\n```\r\n\r\n\r\n---------\r\n\r\nSorry if maybe a bug report wasn't appropriate for this but there doesn't appear to be a lot of documentation out there regarding this error, and none of the open github issues seem to point that this should be an issue anymore, yet here I am facing it :P"},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/224717699","html_url":"https://github.com/ansible/ansible/issues/14710#issuecomment-224717699","issue_url":"https://api.github.com/repos/ansible/ansible/issues/14710","id":224717699,"user":{"login":"nitzmahone","id":6775756,"avatar_url":"https://avatars.githubusercontent.com/u/6775756?v=3","gravatar_id":"","url":"https://api.github.com/users/nitzmahone","html_url":"https://github.com/nitzmahone","followers_url":"https://api.github.com/users/nitzmahone/followers","following_url":"https://api.github.com/users/nitzmahone/following{/other_user}","gists_url":"https://api.github.com/users/nitzmahone/gists{/gist_id}","starred_url":"https://api.github.com/users/nitzmahone/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nitzmahone/subscriptions","organizations_url":"https://api.github.com/users/nitzmahone/orgs","repos_url":"https://api.github.com/users/nitzmahone/repos","events_url":"https://api.github.com/users/nitzmahone/events{/privacy}","received_events_url":"https://api.github.com/users/nitzmahone/received_events","type":"User","site_admin":false},"created_at":"2016-06-08T20:30:30Z","updated_at":"2016-06-08T20:30:30Z","body":"No- a top level ini inventory file (something as simple as):\r\n```\r\nwin7-90day ansible_winrm_server_cert_validation=ignore\r\n```\r\n\r\nThe issue appears to be that some of the group_vars/host_vars resolution got moved past the fork boundary, so the connection workers aren't seeing all the inventory vars."}}
{"actor":{"display_login":"nitzmahone"}}