[Samba] samba + cups

[Robert Gehr]

Hello everyone

I hope this is not off topic.

The samba + cups thing is driving me nuts.
Samba runs as PDC and print server.
Everything is fine, printing works, automatic driver download works etc.
Now I want only certain people to be able to stop a printer under windows.
After digging around a bit I set my cupsd.conf file up like so:

<Policy default>
   <Limit Send-Document Resume-Printer Send-URI Hold-Job Release-Job 
Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription 
Renew-Subscription Cancel-Subscription Get-Notifications Reprocess-Job 
Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job>
     Allow from @LOCAL
     Order deny,allow
   </Limit>
   <Limit Pause-Printer Resume-Printer Set-Printer-Attributes 
Enable-Printer Disable-Printer Pause-Printer-After-Current-Job 
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer 
Restart-Printer Shutdown-Printer Startup-Printer Promote-Job 
Schedule-Job-After CUPS-Add-Printer CUPS-Delete-Printer CUPS-Add-Class 
CUPS-Delete-Class CUPS-Accept-Jobs CUPS-Reject-Jobs CUPS-Set-Default>
     AuthType BasicDigest
     Require user @Admin-Group
     Order deny,allow
   </Limit>
   <Limit CUPS-Authenticate-Job>
     Require user @OWNER @SYSTEM
     Require user  @Admin-Group
     Satisfy any
     Order deny,allow
   </Limit>

This has no effect at all. The strange thing is that cups logs the 
following when I pause and unpause a printer under Windows.

E [11/Mar/2008:13:29:43 +0100] Pause-Printer: Unauthorized
I [11/Mar/2008:13:29:43 +0100] Saving printers.conf...
I [11/Mar/2008:13:29:43 +0100] Printer "IT-Laser1" stopped by "root".
I [11/Mar/2008:13:29:47 +0100] Saving printers.conf...
I [11/Mar/2008:13:29:47 +0100] Printer "IT-Laser1" started by "rob".

Why is the thing being stopped by root and started by me (rob)??
Do the settings in cupsd.conf make any sense at all in combination with 
samba because samba runs as root and whatever a user does is seen by 
cups as being done by root??????

Maybe I'm on the wrong track altogether.

Help is greatly appreciated.

Regards
Rob