[cups.bugs] [HIGH] STR #2751: Can't authenticate IPP job

[twaugh.redhat]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

When a job is submitted for a printer with an ipp://... URI, and the IPP
backend cannot proceed because the remote IPP instance requires auth-info,
the job cannot be authenticated.

Details:
1. Set up a CUPS server on the network  and share a queue using CUPS
Browsing.  Add this policy fragment:

  <Limit Print-Job Create-Job>
    AuthType Basic
    Require valid-user
  </Limit>

so that authentication is required before a job can be submitted.

2. Configure a CUPS 1.3.6 client to discover browsed printers using CUPS
Browsing

3. On this client machine, submit a print job to the browsed queue.  The
job will stop because authentication is required.

4. Send a CUPS-Authenticate-Job IPP request for that job to the client,
with auto-info set to the correct values.

5. The job restarts but stops again as in step 3.  The authentication
details were not given to the CUPS server.

There are two things wrong:

A. The IPP backend does not try to send authentication details unless it
is running as root, and the scheduler does not run it as root even if it
sets authentication details in the environment.

B. The IPP backend is looking in the environment for AUTH_USERNAME and
AUTH_PASSWORD, but the scheduler sets CUPSD_AUTH_USERNAME and
CUPSD_AUTH_PASSWORD.

Attached is a fix for the second problem.

Link: http://www.cups.org/str.php?L2751
Version: 1.3.6
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: cups-ipp-auth.patch
URL: <http://lists.cups.org/pipermail/cups-devel/attachments/20080312/1a64b252/attachment.ksh>