diff --git a/novajoin/tests/functional/test_enrollment.py b/novajoin/tests/functional/test_enrollment.py
index e8ef0c3..3e49181 100644
--- a/novajoin/tests/functional/test_enrollment.py
+++ b/novajoin/tests/functional/test_enrollment.py
@@ -19,9 +19,9 @@ The test uses the default demo project and credentials and assumes there is a
 centos-image present in Glance.
 """
 
+import io
 import json
 import os
-import StringIO
 import testtools
 import time
 import uuid
@@ -147,7 +147,7 @@ class TestEnrollment(testtools.TestCase):
         # we wouldn't be able to connect to keystone from the same namespace.
 
         pkey = paramiko.RSAKey.from_private_key(
-            StringIO.StringIO(self._key.private_key))
+            io.StringIO(self._key.private_key))
         client = paramiko.SSHClient()
         client.load_system_host_keys()
         client.set_missing_host_key_policy(paramiko.AutoAddPolicy())
@@ -170,7 +170,7 @@ class TestEnrollment(testtools.TestCase):
         stdin, stdout, stderr = ssh.exec_command('id admin')
         self.assertRegex(
             'uid=\d+\(admin\) gid=\d+\(admins\) groups=\d+\(admins\)',
-            stdout.read())
+            stdout.read().decode())
 
     @loopingcall.RetryDecorator(200, 5, 5, (AssertionError,))
     def _check_ipa_client_created(self):
diff --git a/roles/configure-freeipa/tasks/main.yaml b/roles/configure-freeipa/tasks/main.yaml
index b2fe7f9..3ec4f58 100644
--- a/roles/configure-freeipa/tasks/main.yaml
+++ b/roles/configure-freeipa/tasks/main.yaml
@@ -16,6 +16,34 @@
     replace: 'GSS_AUTH_AVAILABLE = False'
   become: true
 
+- name: Install paramiko to patch it (Python3)
+  pip:
+    name: paramiko
+    executable: pip{{ python_version }}
+  become: true
+  when: python_version is defined
+
+- name: Find Paramiko ssh_gss.py (Python3)
+  command: python{{ python_version }} -c "from paramiko import ssh_gss; print(ssh_gss.__file__.rstrip('c'))"
+  register: ssh_gss_file
+  when: python_version is defined
+
+- name: Patch Paramiko (https://github.com/paramiko/paramiko/pull/1311)
+  replace:
+    path: '{{ ssh_gss_file.stdout }}'
+    regexp: 'GSS_EXCEPTIONS = \(gssapi.GSSException,\)'
+    replace: 'GSS_EXCEPTIONS = ()'
+  become: true
+  when: python_version is defined
+
+- name: Patch Paramiko (https://github.com/paramiko/paramiko/pull/1311)
+  replace:
+    path: '{{ ssh_gss_file.stdout }}'
+    regexp: 'GSS_AUTH_AVAILABLE = True'
+    replace: 'GSS_AUTH_AVAILABLE = False'
+  become: true
+  when: python_version is defined
+
 - name: Uninstall urllib3 to fix later conflict with python-urllib3 system package
   pip:
     name: urllib3