[cups.general] Print-Job operation

[Michael R Sweet]

angelb wrote:
>> angelb wrote:
>>>> angelb wrote:
>>>>> ...
>>>>> Am I totaly confused how this work and unknowingly misconfigured CUPS
>>>>> to act this way? Or is that how Print-Job is designed to work?
>>>> You can require a valid user without specifying the AuthType in
>>>> the Limit section; this will allow command-line users to supply
>>>> the requesting-user-name attribute with the current username, but
>>>> web users will need to authenticate to provide their username.
>>>>
>>>> So:
>>>>
>>>>      <Limit Print-Job Create-Job Send-Document>
>>>>      Require valid-user
>>>>      </Limit>
>>>>
>>>> --
>>> I would have preferred to leave the commad-line users alone. This way,
>>> there's no need to modify existing applications.
>> That's the way it works; "lp" and "lpr" pull the username from
>> the current UID and supply the requesting-user-name attribute in
>> the print requests, so no password will be required.
>>
>> Since the web interface doesn't have a logged-in user, we look
>> for the authenticated username (REMOTE_USER env var in the CGI
>> environment) and only pass requesting-user-name when it is set.
>>
>> So, "Require valid-user" will do what you want...
> 
> Not quite there yet. I've set the Limit per your suggestion above
> and lpr was able to print without needing authentication.
> 
>>From the web interface, I was still able to Print Test Page to any
> printer in the class without authentication. Username used to print
> the test page is "guest" as seen listed from "Show All Jobs" for the
> printer:

File a bug report for this; I looked at the code and for test pages
we are passing "guest" when REMOTE_USER isn't set... (Oops!)

http://www.cups.org/str.php

-- 
______________________________________________________________________
Michael R Sweet                        Senior Printing System Engineer