cupsdAuthorize: Error accepting GSSAPI security context: ....

[Andy Crow]

Dear Cups developers,
I'm running redhat 5.5 with cups 1.3.7 and I'm trying to configure
kerberos authentication. I need your help because an error appear in
log file:

"cupsdAuthorize: Error accepting GSSAPI security context: Invalid token was supplied, No error"

and the user identification doesn't work.

This is the cupsd.conf:

MaxLogSize 2000000000
LogLevel debug2
SystemGroup sys root
# Allow remote access
Port 631
Listen /var/run/cups/cups.sock
# Enable printer sharing and shared printers.
Browsing On
BrowseOrder allow,deny
# (Change '@LOCAL' to 'ALL' if using directed broadcasts from another subnet.)
BrowseAllow @LOCAL
BrowseAddress @LOCAL
DefaultAuthType Negotiate
<Location />
  # Allow shared printing...
  AuthType Default
  Order allow,deny
  Allow all
</Location>
<Location /admin>
  Encryption Required
  Order allow,deny
</Location>
<Location /admin/conf>
  AuthType Default
  Require user @SYSTEM
  Order allow,deny
</Location>
<Policy default>
  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscri
ption Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-
Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept
-Jobs CUPS-Reject-Jobs>
    AuthType Default
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  <Limit Cancel-Job CUPS-Authenticate-Job>
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  <Limit All>
    Order deny,allow
  </Limit>
</Policy>

and the following are the release of the most important rpm packages:

krb5-auth-dialog-0.7-1
pam_krb5-2.2.14-21.el5
krb5-workstation-1.6.1-62.el5
krb5-libs-1.6.1-62.el5
cups-libs-1.3.7-26.el5_6.1
cups-1.3.7-26.el5_6.1
libgssapi-0.10-2

the error_log file:


d [14/Sep/2011:12:51:13 +0200] cupsdAuthorize: Authorization="Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=="
D [14/Sep/2011:12:51:13 +0200] get_gss_creds: Attempting to acquire credentials for ipp at hostname.domain...
D [14/Sep/2011:12:51:13 +0200] get_gss_creds: Credentials acquired successfully for ipp at hostname.domain.
D [14/Sep/2011:12:51:13 +0200] cupsdAuthorize: Error accepting GSSAPI security context: Invalid token was supplied, No error
d [14/Sep/2011:12:51:13 +0200] cupsdIsAuthorized: con->uri="/cups.css", con->best=0x9360810(/)


thanks a lot in advance for your help !!!!!

V.B.Regards

Andy