Issue 1:
ISSUE TYPE

Bug Report

COMPONENT NAME

copy

ANSIBLE VERSION

ansible 2.4.0.0

CONFIGURATION

ANSIBLE_SSH_ARGS(/Users/dude/dev/www-ansible/ansible.cfg) = -o StrictHostKeyChecking=no

DEFAULT_HASH_BEHAVIOUR(/Users/dude/dev/www-ansible/ansible.cfg) = merge

DEFAULT_HOST_LIST(/Users/dude/dev/www-ansible/ansible.cfg) = [u'/Users/dude/dev/www-ansible/inventory/hosts']

DEFAULT_ROLES_PATH(/Users/dude/dev/www-ansible/ansible.cfg) = [u'/Users/dude/dev/www-ansible/roles']

DEFAULT_VAULT_PASSWORD_FILE(/Users/dude/dev/www-ansible/ansible.cfg) = /Users/dude/dev/www-ansible/vaultpassword

HOST_KEY_CHECKING(/Users/dude/dev/www-ansible/ansible.cfg) = False

OS / ENVIRONMENT

MacOs Sierra 10.12.3 (16D32)

SUMMARY

Copy module won't copy files over to remote host if files are vaulted(encrypted) and have no extension

STEPS TO REPRODUCE

put vaulted(encrypted) files in host_vars/{{ inventory_hostname }}/files/var/www/

run ansible-playbook -vvv webservers.yml

name: Include host-specific files in /var/www/, set owner, group and mode
copy: src=host_vars/{{ inventory_hostname }}/files/var/www/ dest=/var/www/ owner=www-data group=www-data mode="0775"

EXPECTED RESULTS

unencrypt and copy files over to remote host

ACTUAL RESULTS

PLAY [apply configuration to all staging nodes] ************************************************************************************************************************************************************
ERROR! failed to combine variables, expected dicts but got a 'dict' and a 'AnsibleUnicode':

Issue 2:
ISSUE TYPE

Bug Report

COMPONENT NAME

winrm

ANSIBLE VERSION

ansible 2.2.0
config file = /etc/ansible/ansible.cfg
configured module search path = ['/usr/share/ansible']

CONFIGURATION

Not aware of any changes in ansible.cfg.

Otherwise using the following in the vault besides the username/password.

ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore

OS / ENVIRONMENT

Issues with two Windows 2008R2 hosts.

SUMMARY

When attempting to use module win_ping against two hosts, I am getting the following error:

kerberos: the specified credentials were rejected by the server, ssl: 401 Unauthorized.

STEPS TO REPRODUCE

Create a vault file with the following

ansible_ssh_user: user@fqdn
ansible_ssh_pass: <secret>
ansible_ssh_port: 5986
ansible_connection: winrm
ansible_winrm_server_cert_validation: ignore

Create the kerberos ticket with kinit.

Execute the Ansible ping:

ansible windows -i hosts --ask-vault-pass -m win_ping

EXPECTED RESULTS

I expect the hosts to return a successful pong.

fqdn | SUCCESS => {
"changed": false,
"invocation": {
"module_name": "win_ping"
},
"ping": "pong"
}

ACTUAL RESULTS

Using module file /home/ccoager/ansible/venv/lib/python2.7/site-packages/ansible/modules/core/windows/win_ping.ps1
<fqdn> ESTABLISH WINRM CONNECTION FOR USER: username@fqdn on PORT 5986 TO fqdn
fqdn | UNREACHABLE! => {
"changed": false,
"msg": "kerberos: the specified credentials were rejected by the server, ssl: 401 Unauthorized.",
"unreachable": true
}

ADDITIONAL INFO

I have checked some of the obvious stuff as part of troubleshooting. The username I am using to connect is part of the local administrators group. I have run the ConfigureRemotingForAnsible.ps1 script. I checked the A and PTR DNS records, they are correct with no duplicates.

I believe I have narrowed down the root cause. I have this working for a few hundred hosts so this issue is specific to two hosts. I examined the SPN records and it has additional entries for HTTP.

HTTP/<shortname>
http/<shortname>:80
http/<fqdn>
http/<fqdn>:80

I believe this is conflicting with normal connections via WinRM. The account running on the HTTP address does not have local administrator rights so it makes sense that it is using this account instead of the one specified. Attempting to connect using Powershell fails as well. However, if you include the New-PSSessionOption flag -IncludePortInSPN, the connection is successful. Is there an equivalent option in Ansible?

New-PSSessionOption