Windows IPP client does not prompt for password

John A. Sullivan III jsullivan at opensourcedevel.com
Wed Jan 19 06:58:39 PST 2011


Hello, all.  We have a problem where our Windows clients are not prompted to enter a user name and password when managing their printers or documents.  Our  packet traces show that the Windows client passes the user name, the CUPS server asks for the user name and password combination, and then the windows client does not prompt the user for a password but simply gives an Access Denied error.

We are using a CUPS 1.4.4-3 on Debian as the print server and have several Windows Remote Desktop clients on a Windows 2008 server.  They are configured to print directly to the CUPS printers.  We are using basic authentication and encrypted connections on a non-standard port.  I've temporarily disabled encryption to take packet traces to analyze our problem.

It is a multi-tenant environment so we do restrict access to the printers to specific addresses and user accounts.  Users must authenticate to manipulate the printers and print queues.  If we edit the port on the Windows printer definition and enter the user's LDAP ID and password (we use Redhat Directory Server for all of our authentication - this synchronizes with AD), all works fine but we do not want to hard set the user name and password.  For one, it is way too much overhead for a large environment and, two, we don't want printing to break every time a user changes their password.  We thus set the ports to default to Automatically Use the Windows Logon Name and Password.  However it does not pass the password.  So we thought we would set it to the user name and leave the password blank but that does not work either.  Our packet traces sow the behavior describe above - it sends the user name, CUPS asks for user name and password and the Windows client returns an Access Denied error.

How does one set up a secure Windows/CUPS environment without SAMBA? Is there a way to get the Windows CUPS client to prompt for credentials rather than just giving up? Thanks - John




More information about the cups mailing list