Arch Linux

cycomanic

Member

Registered: 2022-05-16

Posts: 5

CUPS with Kerberos does not work

Hi all,

has anyone been able to make CUPS and kerberos work? I'm trying to print on my work network with kerberos authentification and it seems CUPS is not using the kerberos details. I've been searching for some solution but am not getting anywhere. What I've done:

1. Make sure I have a kerberos ticket. klist output (note configuration is provided by work):
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: xxxx@xxxx.se

Valid starting     Expires            Service principal
16/05/22 08:37:26  17/05/22 08:37:22  krbtgt/xxx.se@xxx.se

2. Set DefaultAuthType negotiate in /etc/cups/cupsd.conf

3. connect IPP printer and check that printer is connected (I can read out the toner status etc.)

4. make sure that /usr/lib/cups/backends/ipp is set chmod 700

When I print my jobs still get "held for authentification" in the job queue and in the logs I get "No authentication data provided"

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,284

Re: CUPS with Kerberos does not work

4. make sure that /usr/lib/cups/backends/ipp is set chmod 700

$ ls -l /usr/lib/cups/backend/ipp
-rwxr--r-- 1 root root 79800 27 jan 17:58 /usr/lib/cups/backend/ipp
$

Are you sure that needs to be 700 and not 744 ?

Is the print server part of a domain ?
Have you tried sending a document directly through lpd or other cli methods ?

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

cycomanic

Member

Registered: 2022-05-16

Posts: 5

Re: CUPS with Kerberos does not work

4. make sure that /usr/lib/cups/backends/ipp is set chmod 700

$ ls -l /usr/lib/cups/backend/ipp
-rwxr--r-- 1 root root 79800 27 jan 17:58 /usr/lib/cups/backend/ipp
$

Are you sure that needs to be 700 and not 744 ?

According to https://github.com/apple/cups/issues/5233  ipp should be set to 700 for kerberos. However, I initially had set ipp to 744 as well, and only changed to 700 after it didn't work and I came across the github issue. So this should not be what is going on.

Is the print server part of a domain ?
Have you tried sending a document directly through lpd or other cli methods ?

Yes print server is part of an AD domain. I tried printing via lqr and the document just ends up in the queue, I can also add the printer through a smb print server (set up for windows users I guess)  and if I print directly using smbclient it works, however through cups does not work.

Lone_Wolf

Administrator

From: Netherlands, Europe

Registered: 2005-10-04

Posts: 15,284

Re: CUPS with Kerberos does not work

archlinux cups moved away from apple cups and uses openprinting cups.

https://github.com/OpenPrinting/cups/issues/373 looks relevant and mentions needing to set auth-info-required .

Welcome to archlinux forums .

---

Disliking systemd intensely, but not satisfied with alternatives so focusing on taming systemd.

clean chroot building not flexible enough ?
Try clean chroot manager by graysky

cycomanic

Member

Registered: 2022-05-16

Posts: 5

Re: CUPS with Kerberos does not work

archlinux cups moved away from apple cups and uses openprinting cups.

https://github.com/OpenPrinting/cups/issues/373 looks relevant and mentions needing to set auth-info-required .

Setting auth-info-required to any value does not seem to make a difference, but thanks for pointing out that arch moved to openprinting cups I was not aware of that.

Welcome to archlinux forums .

Thanks

Delt4

Member

Registered: 2022-05-31

Posts: 1

Re: CUPS with Kerberos does not work

cups has deprecated Kerberos support in 2.4 (see https://github.com/OpenPrinting/cups/issues/98 )

Because cups is not compiled with Kerberos by default now, the maintainers of the package didn't add that option ( see Bug archlinux report )

You can compile the package yourself with --enable-gssapi.

Last edited by Delt4 (2022-05-31 06:49:02)