[cups.general] Novell IPrint: Iprint does not show password popupbox

[Johannes Meixner]

Hello,

On Feb 19 08:19 Michael Sweet wrote:
> Till Kamppeter wrote:
> > See the following Ubuntu bug report
> > 
> > https://bugs.edge.launchpad.net/ubuntu/+source/cupsys/+bug/192095
> > 
> > It seems that there is a problem with a special IPrint backend to print 
> > on Novell servers which got already fixed for CUPS on Mac OS X. Did this 
> > problem also get fixed in CUPS for Linux and Unix? Or is the reporter of 
> > the bug suffering another problem?
> 
> There isn't enough information to say.  Ubuntu uses GNU TLS, Mac OS X
> uses CDSA, and the other distros use OpenSSL.  Assuming that the "fix"
> was made to the CDSA framework on Mac OS X, my guess would be that
> you are seeing either a GNU TLS bug or an issue in Novell's software.

Unfortunately both the iPrint server software and the iPrint client
software are closed source so that even I don't know what is going
on there internally.

All I can tell at the moment is some very basic information:

When there is no authentication required to submit a job
from a client workstation to an iPrint server, no special
software is needed on the client system - i.e. the generic
CUPS "ipp" backend is sufficient to send the job.
I assume it is even sufficient when only the data transfer
should be secured via SSL (via an ipp URI "encryption" option)
but when no explicite user authentication is required.

When user authentication is required to submit a job from a client
workstation to an iPrint server, the special Novell iPrint client
software is needed on the client system which provides in particular
a special "iprint" backend (together with a Mozilla/Firefox
browser plugin "npnipp.so" and a "iprint-listener" program)
which do "all what is needed" to submit the job.

I can only guess that the special Novell iPrint client software
might even establish an authentication dialog with the user?
Perhaps it is not SSL what fails but that it fails to establish
the authentication dialog?
Perhaps the "iprint" backend provides helpful debugging information
via stderr so that the CUPS error_log file might help?


Additionally there is another kind of authentication.
>From a README regarding the Novell iPrint client software:
-------------------------------------------------------------------
The Linux iPrint Client is packaged in two different, specialized
installations that control access to the workstation's print system.
The following table explains the differences between the two clients:

novell-iprint-xclient-sh-6.500.20070105-0.4.i586.rpm:
Security high. Limited access to the print system.

This client requires workstation users to be defined with lppasswd
to install, delete, or administer printers on the workstation.
When performing one of these print operations, the user is challenged
for a password.

novell-iprint-xclient-sl-6.500.20070105-0.4.i586.rpm:
Security low. Unlimited access to the print system.

This client allows all users of the workstation to install, delete,
or administer printers and print jobs on the workstation,
including printers and print jobs of other users. 
-------------------------------------------------------------------

Note that both RPMs write into cupsd.conf and restart the cupsd
(via RPM postinstall script) to establish their kind of "security".


Kind Regards
Johannes Meixner
-- 
SUSE LINUX Products GmbH, Maxfeldstrasse 5, 90409 Nuernberg, Germany
AG Nuernberg, HRB 16746, GF: Markus Rex