How is backend authentication supposed towork ?

Christer Bernérus bernerus at chalmers.se
Thu Mar 11 06:46:02 PST 2010


>
> --Apple-Mail-8-18679817
> Content-Transfer-Encoding: quoted-printable
> Content-Type: text/plain;
> 	charset=iso-8859-1
>
> On Mar 10, 2010, at 1:40 AM, Christer Bern=C3=A9rus wrote:
> > ...
> > How is this supposed to work, really? How is the local CUPS scheduler =
> supposed to get hold of the original submitter's credentials?
>
>
> The local cupsd gets a copy of the user's Kerberos credentials and then =
> supplies them to the backend, which uses them when a challenge is =
> received from the remote server.

>From what I can see, both in the code and in reality (Mac), the backend
returns CUPS_BACKEND_AUTH_REQUIRED. When that happens, the scheduler
puts the job on hold until "auth-info-required" which in reality seems to be indefinitely.

Is the printer proxy supposed to do something about this held job?

>
> On Mac OS X we use a special interface that allows us to do this without =
> delegation on the local system, however other operating systems need =
> delegated credentials, typically enabled via a policy setting on the =
> KDC.

OK, Thanks for info. I think we could handle delegation on desktop machines. Harder on laptops.
Fortunately most laptops run MacOS (or Windows).

>
> There are some known issues in CUPS 1.4.2, and fixes are attached to =
> CUPS STR #3325:
>
>     http://www.cups.org/str.php?L3325
>
I'm aware of these.




More information about the cups mailing list