Handling Windows authentication and encryption when using WinRM
Now that we have established the basic level of connectivity required for Ansible to perform tasks on a Windows host using WinRM, let's dig deeper into the authentication and encryption side of things. In the earlier part of the chapter, we used the basic authentication mechanism with a local account. While this is fine in a testing scenario, what happens in a domain environment? Basic authentication only supports local accounts, so clearly we need something else here. We also chose not to validate the SSL certificate (as it was self-signed), which again, is fine for testing purposes, but is not best practice in a production environment. In this section, we will explore options for improving the security of our Ansible communications with Windows.
Authentication mechanisms
Ansible, in fact, supports five different Windows authentication mechanisms when WinRM is used, as follows:
- Basic: Supports...