[cups.general] Cups with GSSAPI and Samba

[Michael Sweet]

Loren M. Lang wrote:
> I have been using Cups as my backend for printing for years, but only in
> combination with Samba and Windows Workstations.  We have recently
> started deploying Ubuntu 8.04 for a couple of workstations and I'd like
> to have them be able to print directly to the Cups server instead of
> going through Samba.  Since we have MIT Kerberos deployed and are using
> it for other services like NFS and IMAP, I'd like to use Negotiate
> authentication with Kerberos, but when I changed the default
> authentication from Basic to Negotiate in cupsd.conf, I find that it
> breaks Samba printing.  From what I understand, Samba communicates with
> Cups over a UNIX domain socket while operating as the UNIX user that is
> doing the printing.  Cups is able to query the UNIX domain socket to
> find out what user id is connected and authenticates the connection as
> that user without need for a password.  When the authentication is
> changed to Negotiate from Basic, it now requires a Kerberos ticket and
> breaks Samba's ability to print.  Am I correct?  And is there a way to
> allow Basic authentication with sockets and Negotiate with IPv4/IPv6
> connections?

No, however you *can* use the Satisfy directive to allow local
connections without authentication, e.g.:

     <Location />
     Order Allow,Deny
     AuthType Negotiate
     Satisfy any
     </Location>

-- 
______________________________________________________________________
Michael Sweet, Easy Software Products           mike at easysw dot com