[Samba] Access denied when associating a driver with a printer

[James Cort]

On 4 Nov 2013, at 18:04, Marc Muehlfeld <samba at marc-muehlfeld.de> wrote:

> Hello James,
> 
> Am 04.11.2013 13:32, schrieb James Cort:
>> I'm trying to get point & print working against a 4.0.10 Samba server (using the sernet packages if that's relevant).
>> 
>> I have the printer itself setup and I've uploaded the driver, but associating the uploaded driver with the printer causes Windows to give an error: "Printer settings could not be saved. Access is denied".
>> 
>> I'm seeing the same symptoms on XP and 7, and if I use rpcclient from the command line I get WERR_ACCESS_DENIED.
> 
> Have you checked
> http://wiki.samba.org/index.php/Samba_as_a_print_server
> 
> Maybe you missed anything?

That would be the most obvious explanation - but I don't believe I have. 

I present my own checks here - partly to confirm with the list that I haven't left anything out, partly because if there's a bug somewhere in either documentation or Samba, with any luck this will shake it out.


Going over the given instructions, I need:

 - To have a printer set up in cups, with a raw backend.

TEST: lpstat -p

RESULT: printer Kyocera is idle.  enabled since Mon 04 Nov 2013 11:17:59 AM GMT

 - To have a spool directory, permissions 1777

TEST: ls -ld /var/spool/samba
RESULT:  drwxrwxrwt 2 root root 4096 Nov  3 20:01 /var/spool/samba/

 - To have a printer driver directory, permissions 755.

TEST:  ls -ld /var/lib/samba/printers
RESULT:  drwxr-xr-x 3 root root 4096 Nov  3 15:28 /var/lib/samba/printers

 - To have a [printers] section in my smb.conf that lists a path, the line "printable = yes" and "printing = CUPS". 
 - To have a [print$] section that lists a path and is writeable.

TEST: testparm

RESULT:
~~~~
[printers]
	comment = All Printers
	path = /var/spool/samba
	printable = Yes
	print ok = Yes
	browseable = No
~~~~~

[print$]
	path = /var/lib/samba/printers
	read only = No

 - To have load printers = yes in my smb.conf (It is there, but it doesn't appear when I run testparm. Is this relevant?)

TEST:  grep "load printers" /etc/samba/smb.conf
RESULT:  load printers = yes

 - To grant myself SePrintOperatorPrivilege

TEST: net rpc rights list accounts -Uadministrator
RESULT:

~~~
BEDIWIN\Administrator
SePrintOperatorPrivilege
~~~~

(full results at http://pastebin.com/20dr3cWE)

 - To ensure a driver has been uploaded.

TEST:  rpcclient localhost -U administrator -c 'enumdrivers'
RESULT: 
Enter administrator's password: 

[Windows NT x86]
Printer Driver Info 1:
	Driver Name: [Kyocera FS-C5250DN KX]

 - To ensure the printer itself has been found and may be enumerated by Samba

TEST: rpcclient localhost -U administrator -c 'enumprinters'
RESULT:
Enter administrator's password: 
	flags:[0x800000]
	name:[\\LOCALHOST\Kyocera]
	description:[\\LOCALHOST\Kyocera,,Kyocera]
	comment:[Kyocera]


My understanding was that all is present and correct, and yet the final part of the jigsaw - associate a printer with a driver - gives the result:

# rpcclient localhost -U"Administrator" -c 'setdriver "Kyocera" "Kyocera FS-C5250DN KX"'
Enter Administrator's password: 
SetPrinter call failed!
result was WERR_ACCESS_DENIED


Is it worth looking at the underlying .tdb files to see if there's anything amiss there?


James.