[cups.general] Printing to a kerberized SMB printer (Windows) - the missing link

[Michael R Sweet]

Adrian Gschwend wrote:
> ...
> IMHO CUPS should fork the smbspool process into the user which requested
> the print, get the kerberos ticket (I suppose there are some APIs
> available for that as the forked process probably won't see the
> KRB5CCNAME env variable) and print like this.

That won't help since the user may not have a local account and won't
have the credentials.

Recent releases of Samba support the CUPS 1.3.x auth-info-required
interface which allows cupsd to forward the user's Kerberos
credentials to smbspool.  Note, however, that this requires the
client be configured with a SGT for the "ipp" service for the
forwarding to work.  See:

     http://svn.easysw.com/public/cups/trunk/doc/help/kerberos.html

for more information.

(The same mechanism is used for Kerberized IPP printing)

-- 
______________________________________________________________________
Michael R Sweet                        Senior Printing System Engineer