Kerberos printing using smbspool backend

[Marcus Moeller]

Dear Jeremy.

>> I am trying to set up Kerberos printing using the cups smbspool backend.
>>
>> The user from which the print job is released is logged in via
>> Kerberos and got a valid ticket.
>>
>> I have not found a lot of information about how to configure cups in
>> order to use Kerberos printing, but by default it prompts for a
>> password.
>>
>> I found some notes that to enable Kerberos ?k should be added to the
>> device uri but no official information about that.
>>
>> Other sources state that AuthInfoRequired negotiate needs to be set,
>> but none of that helped, either.
>>
>> Could one of you please point out which steps are required in order
>> to print through smbspool using Kerberos?
>
> As I recall it's fiddly and distro dependent. The user has
> to have a ticket in their kerberos cache and the cups driver
> has to have setuid'ed to the correct user before invoking
> smbspool -k.

Hmm, there has at least been a patch submitted bach in 2005 which should 
handle the setuid to the user process:

https://lists.samba.org/archive/samba-technical/2005-May/040629.html

> I think SuSE do this right out of the box, not sure about
> Ubuntu or Fedora.

On Red Hat/Fedora, the backend simply links to smbspool. (open)SUSE 
provides a helper which is part of samba-krb-printing. I have tried it 
out on openSUSE 12.3 but it does not work.

The problem has been mentioned in different areas, e.g.:

https://bugs.launchpad.net/ubuntu/+source/cups/+bug/788167

But as cups has nearly closed public resources like the bugtracker, it's 
really hard to find out more.

Greetings
Marcus



-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4255 bytes
Desc: S/MIME Kryptografische Unterschrift
URL: <http://lists.samba.org/pipermail/samba-technical/attachments/20130906/570118f0/attachment.bin>