<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">copy</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.4.0.0"><pre class="notranslate"><code class="notranslate">ansible 2.4.0.0
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">ANSIBLE_SSH_ARGS(/Users/dude/dev/www-ansible/ansible.cfg) = -o StrictHostKeyChecking=no<br>
DEFAULT_HASH_BEHAVIOUR(/Users/dude/dev/www-ansible/ansible.cfg) = merge<br>
DEFAULT_HOST_LIST(/Users/dude/dev/www-ansible/ansible.cfg) = [u'/Users/dude/dev/www-ansible/inventory/hosts']<br>
DEFAULT_ROLES_PATH(/Users/dude/dev/www-ansible/ansible.cfg) = [u'/Users/dude/dev/www-ansible/roles']<br>
DEFAULT_VAULT_PASSWORD_FILE(/Users/dude/dev/www-ansible/ansible.cfg) = /Users/dude/dev/www-ansible/vaultpassword<br>
HOST_KEY_CHECKING(/Users/dude/dev/www-ansible/ansible.cfg) = False</p>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">MacOs Sierra 10.12.3 (16D32)</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">Copy module won't copy files over to remote host if files are vaulted(encrypted) and have no extension</p>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">put vaulted(encrypted) files in host_vars/{{ inventory_hostname }}/files/var/www/<br>
run ansible-playbook -vvv webservers.yml</p>

<div class="highlight highlight-source-yaml notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="name: Include host-specific files in /var/www/, set owner, group and mode
  copy: src=host_vars/{{ inventory_hostname }}/files/var/www/ dest=/var/www/ owner=www-data group=www-data mode=&quot;0775&quot;"><pre class="notranslate"><span class="pl-ent">name</span>: <span class="pl-s">Include host-specific files in /var/www/, set owner, group and mode</span>
  <span class="pl-ent">copy</span>: <span class="pl-s">src=host_vars/{{ inventory_hostname }}/files/var/www/ dest=/var/www/ owner=www-data group=www-data mode="0775"</span></pre></div>

<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">unencrypt and copy files over to remote host</p>
<h5 dir="auto">ACTUAL RESULTS</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="PLAY [apply configuration to all staging nodes] ************************************************************************************************************************************************************
ERROR! failed to combine variables, expected dicts but got a 'dict' and a 'AnsibleUnicode':"><pre class="notranslate"><code class="notranslate">PLAY [apply configuration to all staging nodes] ************************************************************************************************************************************************************
ERROR! failed to combine variables, expected dicts but got a 'dict' and a 'AnsibleUnicode':
</code></pre></div>
<h5 dir="auto">ISSUE TYPE</h5>
<ul dir="auto">
<li>Bug Report</li>
</ul>
<h5 dir="auto">COMPONENT NAME</h5>
<p dir="auto">winrm</p>
<h5 dir="auto">ANSIBLE VERSION</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible 2.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/usr/share/ansible']"><pre class="notranslate"><code class="notranslate">ansible 2.2.0
  config file = /etc/ansible/ansible.cfg
  configured module search path = ['/usr/share/ansible']
</code></pre></div>
<h5 dir="auto">CONFIGURATION</h5>
<p dir="auto">Not aware of any changes in ansible.cfg.<br>
Otherwise using the following in the vault besides the username/password.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore"><pre class="notranslate"><code class="notranslate">ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore
</code></pre></div>
<h5 dir="auto">OS / ENVIRONMENT</h5>
<p dir="auto">Issues with two Windows 2008R2 hosts.</p>
<h5 dir="auto">SUMMARY</h5>
<p dir="auto">When attempting to use module win_ping against two hosts, I am getting the following error:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="kerberos: the specified credentials were rejected by the server, ssl: 401 Unauthorized."><pre class="notranslate"><code class="notranslate">kerberos: the specified credentials were rejected by the server, ssl: 401 Unauthorized.
</code></pre></div>
<h5 dir="auto">STEPS TO REPRODUCE</h5>
<p dir="auto">Create a vault file with the following</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible_ssh_user: user@fqdn
ansible_ssh_pass: &lt;secret&gt;
ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore"><pre class="notranslate"><code class="notranslate">ansible_ssh_user: user@fqdn
ansible_ssh_pass: &lt;secret&gt;
ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore
</code></pre></div>
<p dir="auto">Create the kerberos ticket with kinit.</p>
<p dir="auto">Execute the Ansible ping:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="ansible windows -i hosts --ask-vault-pass -m win_ping"><pre class="notranslate"><code class="notranslate">ansible windows -i hosts --ask-vault-pass -m win_ping
</code></pre></div>
<h5 dir="auto">EXPECTED RESULTS</h5>
<p dir="auto">I expect the hosts to return a successful pong.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="fqdn | SUCCESS =&gt; {
    &quot;changed&quot;: false,
    &quot;invocation&quot;: {
        &quot;module_name&quot;: &quot;win_ping&quot;
    },
    &quot;ping&quot;: &quot;pong&quot;
}"><pre class="notranslate"><code class="notranslate">fqdn | SUCCESS =&gt; {
    "changed": false,
    "invocation": {
        "module_name": "win_ping"
    },
    "ping": "pong"
}
</code></pre></div>
<h5 dir="auto">ACTUAL RESULTS</h5>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="Using module file /home/ccoager/ansible/venv/lib/python2.7/site-packages/ansible/modules/core/windows/win_ping.ps1
&lt;fqdn&gt; ESTABLISH WINRM CONNECTION FOR USER: username@fqdn on PORT 5986 TO fqdn
fqdn | UNREACHABLE! =&gt; {
    &quot;changed&quot;: false,
    &quot;msg&quot;: &quot;kerberos: the specified credentials were rejected by the server, ssl: 401 Unauthorized.&quot;,
    &quot;unreachable&quot;: true
}"><pre class="notranslate"><code class="notranslate">Using module file /home/ccoager/ansible/venv/lib/python2.7/site-packages/ansible/modules/core/windows/win_ping.ps1
&lt;fqdn&gt; ESTABLISH WINRM CONNECTION FOR USER: username@fqdn on PORT 5986 TO fqdn
fqdn | UNREACHABLE! =&gt; {
    "changed": false,
    "msg": "kerberos: the specified credentials were rejected by the server, ssl: 401 Unauthorized.",
    "unreachable": true
}
</code></pre></div>
<h5 dir="auto">ADDITIONAL INFO</h5>
<p dir="auto">I have checked some of the obvious stuff as part of troubleshooting.  The username I am using to connect is part of the local administrators group. I have run the ConfigureRemotingForAnsible.ps1 script. I checked the A and PTR DNS records, they are correct with no duplicates.</p>
<p dir="auto">I believe I have narrowed down the root cause.  I have this working for a few hundred hosts so this issue is specific to two hosts.  I examined the SPN records and it has additional entries for HTTP.</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="HTTP/&lt;shortname&gt;
http/&lt;shortname&gt;:80
http/&lt;fqdn&gt;
http/&lt;fqdn&gt;:80"><pre class="notranslate"><code class="notranslate">HTTP/&lt;shortname&gt;
http/&lt;shortname&gt;:80
http/&lt;fqdn&gt;
http/&lt;fqdn&gt;:80
</code></pre></div>
<p dir="auto">I believe this is conflicting with normal connections via WinRM.  The account running on the HTTP address does not have local administrator rights so it makes sense that it is using this account instead of the one specified.  Attempting to connect using Powershell fails as well. However, if you include the New-PSSessionOption flag -IncludePortInSPN, the connection is successful. Is there an equivalent option in Ansible?<br>
<a href="https://technet.microsoft.com/en-us/library/hh849703.aspx" rel="nofollow">New-PSSessionOption</a></p>