From ef6f36c702eea28dec90047e6a4cec04348709b3 Mon Sep 17 00:00:00 2001 From: Simone Date: Sun, 17 May 2026 12:24:34 +0200 Subject: [PATCH] fix(winrm): default to NTLM for local-account build VMs pypsrp defaults to auth='negotiate', which attempts Kerberos with no domain and fails under SSPI with SEC_E_UNKNOWN_CREDENTIALS for the workgroup ci_build account. Default to 'ntlm' (configurable). The guest username must be host-qualified (WINBUILD-2025\ci_build) and stored that way in the credential vault. Co-Authored-By: Claude Opus 4.7 --- src/ci_orchestrator/transport/winrm.py | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/src/ci_orchestrator/transport/winrm.py b/src/ci_orchestrator/transport/winrm.py index c5151f6..1a77a2f 100644 --- a/src/ci_orchestrator/transport/winrm.py +++ b/src/ci_orchestrator/transport/winrm.py @@ -59,6 +59,7 @@ class WinRmTransport: ssl: bool = True, cert_validation: bool = False, connection_timeout: int = 30, + auth: str = "ntlm", ) -> None: self._host = host self._username = username @@ -67,6 +68,12 @@ class WinRmTransport: self._ssl = ssl self._cert_validation = cert_validation self._connection_timeout = connection_timeout + # Build VMs use local (workgroup) accounts. pypsrp defaults to + # 'negotiate', which tries Kerberos with no domain and fails under + # SSPI with SEC_E_UNKNOWN_CREDENTIALS. NTLM is required for local + # accounts. The guest username must also be host-qualified + # (WINBUILD-2025\ci_build), stored that way in the credential vault. + self._auth = auth self._client: Client | None = None # ----------------------------------------------------------- connection @@ -86,6 +93,7 @@ class WinRmTransport: password=self._password, port=self._port, ssl=self._ssl, + auth=self._auth, cert_validation=self._cert_validation, connection_timeout=self._connection_timeout, )