[Samba] Printing problem on RHEL3

[Adam Lins]

Hi, 

I have a problem printing on a RHEL3 server running samba-3.0.9-1.3E.1. The server is configured to authenticates users using a nearby Windows 2000 Active Directory server. Windows users are authenticated to shared drives just fine, but printing from Windows clients is proving impossible. 

Occasionally I can hit a configuration that allows me to add a printer on my PC using the Add Printer wizard (usually by adding 'disable spoolss = yes' to smb.conf). But if I try to connect to the printer share from my Windows PC and print a test page, the test page fails to print and Windows asks to launch the troubleshooter. Looking in the Samba logs I see entries like this:

 [2005/01/13 12:24:46, 3] lib/util_seaccess.c:se_access_check(251)
 [2005/01/13 12:24:46, 3] lib/util_seaccess.c:se_access_check(252)
   se_access_check: user sid is S-1-5-21-1214440339-1580818891-1202660629-2125
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-513
   se_access_check: also S-1-1-0
   se_access_check: also S-1-5-2
   se_access_check: also S-1-5-11
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2183
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2181
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2184
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2185
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2188
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2186
   se_access_check: also S-1-5-21-1214440339-1580818891-1202660629-2187
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3015
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3017
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3019
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3023
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3025
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3027
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3033
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-3035
   se_access_check: also S-1-5-21-15958514-230334199-2340646718-5047
 [2005/01/13 12:24:46, 3] printing/printing.c:print_job_start(2224)
   print_job_start: job start denied by security descriptor

(Those are my, valid SIDs; I see the same SIDs displayed when connecting to a shared drive, followed in the samba log by messages indicating that my SIDs have been mapped correctly to a Unix user account.)

I'm completely stumped about the security descriptor entry: what security descriptor? One on the AD server?

The relevant pieces of the smb.conf are:

 [global]
        server string = Bertha SAMBA server
        netbios name = bertha
        client schannel = auto
        server schannel = auto
        client signing = Auto
        server signing = Auto
        client use spnego = yes
        map to guest = bad user
        winbind enum users = yes
        winbind enum groups = yes
        winbind use default domain = yes
        password server = 192.168.1.3
        ldap ssl = on
        idmap uid = 1000-20000
        idmap gid = 1000-20000
        name resolve order = wins bcast
        disable spoolss = yes
        printcap name = cups
        load printers = yes
        printing = cups
        cups options = raw
        guest account = nobody
        log file = /var/log/samba/%m.log
        max log size = 500
        socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
        local master = no
        domain master = no
        preferred master = no        
        security = ADS
        wins server = 192.168.1.8
        wins proxy = yes
        dns proxy = no

 [printers]
        comment = All Printers
        path = /var/spool/samba
        create mode = 0600
        browseable = no
        public = yes
        printable = yes
        guest ok = yes
        writable = no
        use client driver = yes

This is driving me crazy. I've searched on Google and seen a lot of discussion in the past related to adding 'use client driver = yes' (which I have) and setting the correct permissions on /var/spool/samba (done). This problem seems to be directly related to how SAMBA+AD detemermine user permissions, but beyond that I have no idea what's really wrong or how to fix it. 

Any help appreciated,
-Adam