[cups.bugs] [HIGH] STR #3435: Kerberos authenticated print job gets canceled

[Henric Carlström]

DO NOT REPLY TO THIS MESSAGE.  INSTEAD, POST ANY RESPONSES TO THE LINK BELOW.

[STR New]

Issue:
All Kerberos authenticated print job from a CUPS 1.4.x client gets
canceled.
Print jobs from CUPS 1.3.x gets through without any errors.


Scenario:
Any CUPS 1.4.x client (tested Ubuntu 9.10, Fedora 11, Fedora 12, CentOS
5.4, Solaris 10, MacOSX 10.6) against a Ubuntu 9.10 Server with CUPS
1.4.1.
Using Kerberos authentication (see attached cupsd.conf)
Command "kvno -k /etc/krb5.keytab -S HOST swe-lab-cup-002.swelab.local"
gives the output "HOST/swe-lab-cup-002.swelab.local at SWELAB.LOCAL: kvno =
5, keytab entry valid"
Klients are using a client.conf file with one line "ServerName
swe-lab-cup-002.swelab.local"


Expected if working:
When running the command "lp -d PrinterQueueName /etc/hosts" we get the
reply "lp: successful: ok". Should be getting "request id is
PrinterQueueName-ID (1 file(s))".


Possible problem:
In the error log right before "Send-Document" we get the error;
"cupsdAuthorize: Error accepting GSSAPI security context: Unspecified GSS
failure.  Minor code may provide more information, Request is a replay".
The "Send-Document" command tries to authenticate using no username, fails
and then sends "Cancel-Job".
Both the "Create-Job" and "Cancel-Job" authenticates using Kerberos.

Link: http://www.cups.org/str.php?L3435
Version: 1.4-current
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: cupsd.conf
URL: <http://lists.cups.org/pipermail/cups-devel/attachments/20091130/dd468ef3/attachment.ksh>