[cups.general] cupsdAuthorize: Error accepting GSSAPI securitycontext: ....

[Michael Sweet]

Make sure the clients are also using the newer Kerberos.

On Sep 15, 2011, at 12:31 AM, Andy Crow wrote:

> thanx for you replyu , but with krb5-1.7.1-8 there is a new error:
> 
> cupsdAuthorize: Error accepting GSSAPI security context: An unsupported mechanism was requested, Unknown error
> 
> any other ideas ?
> thank you so much !!!!
> 
> Bye
> 
> 
>> You need at least MIT Kerberos 1.6.3 or later.
>> 
>> Sent from my iPhone
>> 
>> On Sep 14, 2011, at 6:05 AM, Andy Crow <andycrow74 at yahoo.com> wrote:
>> 
>>> Dear Cups developers,
>>> I'm running redhat 5.5 with cups 1.3.7 and I'm trying to configure
>>> kerberos authentication. I need your help because an error appear in
>>> log file:
>>> 
>>> "cupsdAuthorize: Error accepting GSSAPI security context: Invalid token was supplied, No error"
>>> 
>>> and the user identification doesn't work.
>>> 
>>> This is the cupsd.conf:
>>> 
>>> MaxLogSize 2000000000
>>> LogLevel debug2
>>> SystemGroup sys root
>>> # Allow remote access
>>> Port 631
>>> Listen /var/run/cups/cups.sock
>>> # Enable printer sharing and shared printers.
>>> Browsing On
>>> BrowseOrder allow,deny
>>> # (Change '@LOCAL' to 'ALL' if using directed broadcasts from another subnet.)
>>> BrowseAllow @LOCAL
>>> BrowseAddress @LOCAL
>>> DefaultAuthType Negotiate
>>> <Location />
>>> # Allow shared printing...
>>> AuthType Default
>>> Order allow,deny
>>> Allow all
>>> </Location>
>>> <Location /admin>
>>> Encryption Required
>>> Order allow,deny
>>> </Location>
>>> <Location /admin/conf>
>>> AuthType Default
>>> Require user @SYSTEM
>>> Order allow,deny
>>> </Location>
>>> <Policy default>
>>> <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscri
>>> ption Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job Suspend-Current-Job Resume-Job CUPS-Move-Job>
>>>   Require user @OWNER @SYSTEM
>>>   Order deny,allow
>>> </Limit>
>>> <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
>>>   AuthType Default
>>>   Require user @SYSTEM
>>>   Order deny,allow
>>> </Limit>
>>> <Limit Pause-Printer Resume-Printer Enable-Printer Disable-Printer Pause-Printer-After-Current-Job Hold-New-Jobs Release-Held-New-
>>> Jobs Deactivate-Printer Activate-Printer Restart-Printer Shutdown-Printer Startup-Printer Promote-Job Schedule-Job-After CUPS-Accept
>>> -Jobs CUPS-Reject-Jobs>
>>>   AuthType Default
>>>   Require user @SYSTEM
>>>   Order deny,allow
>>> </Limit>
>>> <Limit Cancel-Job CUPS-Authenticate-Job>
>>>   Require user @OWNER @SYSTEM
>>>   Order deny,allow
>>> </Limit>
>>> <Limit All>
>>>   Order deny,allow
>>> </Limit>
>>> </Policy>
>>> 
>>> and the following are the release of the most important rpm packages:
>>> 
>>> krb5-auth-dialog-0.7-1
>>> pam_krb5-2.2.14-21.el5
>>> krb5-workstation-1.6.1-62.el5
>>> krb5-libs-1.6.1-62.el5
>>> cups-libs-1.3.7-26.el5_6.1
>>> cups-1.3.7-26.el5_6.1
>>> libgssapi-0.10-2
>>> 
>>> the error_log file:
>>> 
>>> 
>>> d [14/Sep/2011:12:51:13 +0200] cupsdAuthorize: Authorization="Negotiate TlRMTVNTUAABAAAAl4II4gAAAAAAAAAAAAAAAAAAAAAGAbEdAAAADw=="
>>> D [14/Sep/2011:12:51:13 +0200] get_gss_creds: Attempting to acquire credentials for ipp at hostname.domain...
>>> D [14/Sep/2011:12:51:13 +0200] get_gss_creds: Credentials acquired successfully for ipp at hostname.domain.
>>> D [14/Sep/2011:12:51:13 +0200] cupsdAuthorize: Error accepting GSSAPI security context: Invalid token was supplied, No error
>>> d [14/Sep/2011:12:51:13 +0200] cupsdIsAuthorized: con->uri="/cups.css", con->best=0x9360810(/)
>>> 
>>> 
>>> thanks a lot in advance for your help !!!!!
>>> 
>>> V.B.Regards
>>> 
>>> Andy
>>> 
>>> _______________________________________________
>>> cups mailing list
>>> cups at easysw.com
>>> http://lists.easysw.com/mailman/listinfo/cups
>> 
> 
> _______________________________________________
> cups mailing list
> cups at easysw.com
> http://lists.easysw.com/mailman/listinfo/cups

__________________________________________________
Michael Sweet, Senior Printing System Engineer, PWG Chair