Unhelpful error when server returns 401 Unauthorized

[twglomski]

When I was trying to run a net new setup with Ansible I was getting the following error returned while running Ansible:

fatal: [test-domjointest-0]: UNREACHABLE! => {"changed": false, "msg": "credssp: Server did not response with a CredSSP token after step Credential exchange - actual 'Negotiate, Kerberos, http://schemas.dmtf.org/wbem/wsman/1/wsman/secprofile/https/mutual, Basic realm=\"WSMAN\", CredSSP'", "unreachable": true}

I came to this repo after getting this error as I was stumped as to why the CredSSP auth wasn't working. I used the command on the README.md to run the command via Python and this is the stack trace:

>>> r = requests.post(f"https://{server}:5986/wsman", auth=credssp_auth,verify=False)
/usr/local/lib/python3.10/site-packages/urllib3/connectionpool.py:1056: InsecureRequestWarning: Unverified HTTPS request is being made to host 'test-domjointest.moxehealth.com'. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.io/en/1.26.x/advanced-usage.html#ssl-warnings
  warnings.warn(
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/local/lib/python3.10/site-packages/requests/api.py", line 115, in post
    return request("post", url, data=data, json=json, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/requests/api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 589, in request
    resp = self.send(prep, **send_kwargs)
  File "/usr/local/lib/python3.10/site-packages/requests/sessions.py", line 710, in send
    r = dispatch_hook("response", hooks, r, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/requests/hooks.py", line 30, in dispatch_hook
    _hook_data = hook(hook_data, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/requests_credssp/credssp.py", line 199, in response_hook
    response = self.handle_401(response, **kwargs)
  File "/usr/local/lib/python3.10/site-packages/requests_credssp/credssp.py", line 233, in handle_401
    in_token = self._get_credssp_token(response, credssp_regex, step_name)
  File "/usr/local/lib/python3.10/site-packages/requests_credssp/credssp.py", line 264, in _get_credssp_token
    raise AuthenticationException(error_msg)
requests_credssp.exceptions.AuthenticationException: Server did not response with a CredSSP token after step Credential exchange - actual 'Negotiate, Kerberos, http://schemas.dmtf.org/wbem/wsman/1/wsman/secprofile/https/mutual, Basic realm="WSMAN", CredSSP'

This stack trace guided me to what the actual issue was - a 401 Unauthorized response, which led me to check the permissions for the account that Ansible was assuming and resolve the issue.

Thus there are two fixes we can do here:

1. It would be more helpful for the user if the 401 unauthorized error bubbled up instead of the Server did not response error.
2. Server did not response with a CredSSP token after step is improper grammar and should probably be instead Server did not respond with a CredSSP token after step (from here and here)

Versions installed:

ubuntu@2f2088584fea:~$ pip3 freeze
ansible==8.2.0
ansible-core==2.15.2
boto==2.49.0
boto3==1.28.9
botocore==1.31.9
certifi==2023.7.22
cffi==1.15.1
charset-normalizer==3.2.0
credstash==1.17.1
cryptography==41.0.2
idna==3.4
Jinja2==3.1.2
jmespath==1.0.1
MarkupSafe==2.1.3
packaging==23.1
pycparser==2.21
pyspnego==0.9.1
python-dateutil==2.8.2
pywinrm==0.4.3
PyYAML==6.0.1
requests==2.31.0
requests-credssp==2.0.0
requests-ntlm==1.2.0
resolvelib==1.0.1
s3transfer==0.6.1
six==1.16.0
urllib3==1.26.16
xmltodict==0.13.0