Some notes on Ansible on Windows, networking in particular.
When we're dealing with Active Directory Domain Services,
we're dealing with Kerberos.
Now what are the other auth options with Windows?
Well, you could use basic, but you don't ever want to reduce your security.
You don't want to do anything that could jeopardize a password credential.
So we're assuming Kerberos authentication,
and we want to make sure our Ansible control node,
which, as you remember, is a Linux box or Linux virtual machine.
We want to make sure it can talk Kerberos.
So we'll need to install the Kerberos packages on that server.
I'm getting a little ahead of myself.
We'll also need to configure CredSSP if we are doing delegated credentials.
This is where you have a client make a connection to a server
through one or more intermediary servers,
and we want to actually forward that credential across multiple notes.
So this is Kerberos delegation.
It requires some additional setup in Active Directory.
Know that we can support CredSSP,
that Ansible can handle that delegation with no problem.
You know, if you're thinking, well, beyond Tim,
I thought that Ansible on Windows networking was going to be this
complicated subject like virtual networking on Microsoft Azure.
Now there's a complicated subject for you.
Well, I'm sorry to disappoint you if you feel that way.
It's actually the subject is anticlimactic in a very positive way.
In other words, really from a network traffic standpoint,
you need to make provisions for Ansible to communicate
using TCP 5985 if you're doing WinRM over HTTP or 5986 if
you're using TLS and HTTPS or,
and/or depending, TCP port 22 for SSH. But that's it.
And this goes back to why I keep marveling over how
intelligent the Ansible architecture is.
It's adding no or minimal dependencies on its operation.
It's great.
Now as far as a more robust layer,
things like mutual authentication and line protocol using certificates,
you can configure Ansible to support and ignore certificate validation,
which would therefore support self‑signed certificates.
I would recommend against that for sure.
A good practice is to use self‑signed in dev, but hopefully you have
Active Directory Certificate Services, or AD CS, to follow.