[Samba] printing via smbspool_krb5_wrapper cups backend always asks for user authentication

[Philipp Snizek]

Hi

I run Ubuntu 26 LTS with smbclient package version 4.23.6. I'm trying to get printing to work with cups and Kerberos. The Linux computer is a domain member, Kerberos auth works just fine, the user's keytab is stored in /tmp/krb5cc_UID_<random> according to how SSSD does these things. When I set up cups to use Kerberos (negotiate) and try to print via Windows print server, printing still expects user authentication.
My finding is, that smbspool_krb5_wrapper seems to want the keytab's filename in a predictable way, asking for a filename /tmp/krb5cc_UID omitting <random>, as set by SSSD. For some reason it seems to ignore the user's environment variable KRB5CCNAME which points to /tmp/krb5cc_UID_<random>. When I cp -p /tmp/krb5cc_UID_<random> to /tmp/krb5cc_UID printing works.

I know, I can configure in SSSD in section [domain/MYDOMAN] the parameter krb5_ccname_template = FILE:%d/krb5cc_%U. Well, this gets ignored as well. SSSD will always use /tmp/krb5cc_UID_<random> as krb5ccname template, no matter which value is assigned to krb5_ccname_template. But this is a separate issue and has nothing to do with Samba. I'm mentioning this for completeness sake.
What do I have to do to make cups/smbspool_krb5_wrapper use the authenticated user's KRB5CCNAME environment variable?

Thanks.

Best regards,
Philipp