[cups.general] Cups with GSSAPI and Samba

[Loren M. Lang]

I have been using Cups as my backend for printing for years, but only in
combination with Samba and Windows Workstations.  We have recently
started deploying Ubuntu 8.04 for a couple of workstations and I'd like
to have them be able to print directly to the Cups server instead of
going through Samba.  Since we have MIT Kerberos deployed and are using
it for other services like NFS and IMAP, I'd like to use Negotiate
authentication with Kerberos, but when I changed the default
authentication from Basic to Negotiate in cupsd.conf, I find that it
breaks Samba printing.  From what I understand, Samba communicates with
Cups over a UNIX domain socket while operating as the UNIX user that is
doing the printing.  Cups is able to query the UNIX domain socket to
find out what user id is connected and authenticates the connection as
that user without need for a password.  When the authentication is
changed to Negotiate from Basic, it now requires a Kerberos ticket and
breaks Samba's ability to print.  Am I correct?  And is there a way to
allow Basic authentication with sockets and Negotiate with IPv4/IPv6
connections?
-- 
Loren M. Lang
lorenl at north-winds.org
http://www.north-winds.org/


Public Key: ftp://ftp.north-winds.org/pub/lorenl_pubkey.asc
Fingerprint: 10A0 7AE2 DAF5 4780 888A  3FA4 DCEE BB39 7654 DE5B
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <https://lists.cups.org/pipermail/cups/attachments/20090218/0804bf65/attachment.bin>