2

Let me start with a short description: Target host: RHEL7, kernel 3.10, Python2.7

On the target host, there is a perl script (run by a particular user) which, among others, does stuff like:

kdestroy -A
kinit user@domain -kt path_to_keytab

While on the host I can perform (as the 'scriptrunner' user) all commands without error. Yet, while using ansible I get 'kinit: invalid UID in persistent keyring name while getting default ccache' error.

The playbook is run from AnsibleTower with credentials using 'sudo' escalation mode and playbook itself uses become: yes and become_user: scriptrunner so the user is the same when running the commands from terminal.

I have tried running commands with command module, just

command: /bin/kdestory -A and
command /bin/kinit someuser@domain -kt path_to_keytab.

I have also tried running the whole script as: command: /bin/bash -c -l thescript.sh. the result is always the same.

Why so? Any Ideas?

2
  • 2
    Troubleshooting suggestion: write a small wrapper script that dumps the shell environment to a file under /tmp and invokes the Perl script. Once you have it working with an interactive login, leave the last file written in /tmp and have Ansible connect and invoke the script. Then examine the differences. My guess is there's an environment variable missing from the Ansible sessions, or the $PATH is finding a different kdestroy / kinit.
    – Sotto Voce
    Aug 9, 2022 at 2:11
  • @SottoVoce Your advice turned out to be of gold:) Ansible user had totally different set of ENV variables, infamous KRB5CCNAME among them. Adding source ~/.bashrc && unset KRB5CCNAME solved the problem.:) Thank you for your help Aug 19, 2022 at 18:10

1 Answer 1

0

If running unset KRB5CCNAME did not resolve it, you can create a temporary Kerberos credential cache, which might be required before using kinit or klist for the first time:

export KRB5CCNAME=`mktemp`

If that doesn't work, try to change the value of "default_ccache_name" in /etc/krb5.conf to a local file:

[libdefaults]
# ...
# default_ccache_name = KEYRING:persistent:%{uid}
  default_ccache_name = /tmp/krb5cc_%{uid}

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .