[Samba] Printing with smbspool_krb5_wrapper not working in Ubuntu 16.04

[Van Svensson]

Rowland Penny wrote:

> On Sat, 5 Aug 2017 19:06:49 +0200
> Van Svensson via samba <samba at lists.samba.org> wrote:
> 
> > > > I should have mentioned this earlier, but the users does not exist
> > > > in /etc/passwd, instead they are in LDAP and when they log in to
> > > > the computer they get some Kerberos tickets for the domain and
> > > > the file system. When printing on 14.04 they get another Kerberos
> > > > ticket for the printing system according to "klist" after they
> > > > have done "lpr" and printed a document. On 16.04 nothing is
> > > > printed and the user gets no Kerberos ticket for the printing
> > > > system and the job is left in "lpq".
> > > 
> > > Are your main users running Windows ?
> > > Are they members of an AD domain ?
> > 
> > At my part of the organization most people are running Linux: Ubuntu
> > 14.04 LTS. Right now I am trying to upgrade to Ubuntu 16.04 LTS but
> > after the upgrade the printing does no longer work. Centrally at the
> > organization they are running Windows and we Linux users are using
> > the centrally provided printing system through SMB-Kerberos.
> > Everything works fine in 14.04. After upgrading to 16.04 everything
> > works except the printing.
> > 
> > As I mentioned earlier I see that double backslashes are used in
> > 16.04 when SMBSPOOL_KRB5 is setting KRB5CCNAME, can that cause this
> > problem? Ubuntu 16.04 /var/log/cups/error_log: SMBSPOOL_KRB5 -
> > Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' Ubuntu
> > 14.04 /var/log/cups/error_log: SMBSPOOL_KRB5 - Setting KRB5CCNAME to
> > 'FILE:/tmp/krb5cc_1000'
> > 
> > Do you have any idea about what the error "HTTP_STATE_WAITING Closing
> > for error 32 (Broken pipe)" can tell me in this situation when it is
> > printed right after SMBSPOOL_KRB5 has set KRB5CCNAME?
> > 
> > Also wondering about why I get this right after the above error:
> > "Could not determine network interfaces, you must use a interfaces
> > config line"
> > 
> > (As a side note, not sure if it is interesting, but I see in
> > the /var/log/cups/error_log that SMBSPOOL_KRB5 sets KRB5CCNAME
> > to /tmp/krb5cc_UID (where UID is >= 1000). In our environment the
> > user gets /tmp/krb5cc_UID_RANDOM (where RANDOM is a random string)
> > from Heimdal Kerberos when logging in so in 14.04 (where printing
> > works) you have to create a symbolic link from /tmp/krb5cc_UID
> > to /tmp/krb5cc_UID_RANDOM to have the printing work which we do
> > through a small script in /etc/profile.d/. Maybe this has been fixed
> > in later versions of Samba so that we do not need to create this
> > symbolic link for each user? (Of course I have checked that this
> > symbolic link creation works in 16.04.))
> 
> To be honest, I don't think this really has anything to do with Samba,
> the error messages seem to be coming from cups.

Ok, so if I understand things correctly, in the log sequence below CUPS is calling "smbspool_krb5_wrapper" (since  /usr/lib/cups/backend/smb is a symbolic link to /usr/bin/smbspool_krb5_wrapper) and then CUPS is logging those lines starting with "[Job 89] SMBSPOOL_KRB5", but how can CUPS know that it should set e.g. KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\' - isn't that something coming from smbspool_krb5_wrapper (part of the smbclient package)?

D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Started with uid=0
D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - AUTH_INFO_REQUIRED=negotiate
D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Switching to gid=1000
D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Switching to uid=1000
D [05/Aug/2017:12:52:04 +0200] [Job 89] SMBSPOOL_KRB5 - Setting KRB5CCNAME to \'FILE:/tmp/krb5cc_1000\'
D [05/Aug/2017:12:52:04 +0200] [Client 12] HTTP_STATE_WAITING Closing for error 32 (Broken pipe)
D [05/Aug/2017:12:52:04 +0200] [Client 12] Closing connection.
D [05/Aug/2017:12:52:04 +0200] cupsdSetBusyState: newbusy="Printing jobs and dirty files", busy="Printing jobs and dirty files"
E [05/Aug/2017:12:52:04 +0200] [Job 89] Could not determine network interfaces, you must use a interfaces config line