[cups] Printing from Linux CUPS client to a Windows 2016 print server: 'Unauthorized'

[Robert Sturrock]

I'm trying to get a Linux host running CUPS (RHEL7.4 with CUPS 1.6.3-29)
to print to a Windows 2016 print server, which has IPP enabled on port 80.

The Windows server is enrolled to our AD domain ('LOCALDOMAIN') and requires
authentication for any print jobs.

I have been unable to print successfully from the Linux host via
CUPS - any jobs remain in the local queue with a status of "Held for
Authentication", even though I have a Kerberos TGT when submitting
the job.

As a debugging aid, I thought I would try just using 'ipptool' to carry
out some simple tests, but I get an authentication error here also:

$ klist
Ticket cache: FILE:/tmp/krb5cc_10846_qKpKU2
Default principal: rns at LOCALDOMAIN

Valid starting     Expires            Service principal
03/11/17 22:39:01  04/11/17 08:39:01  krbtgt/LOCALDOMAIN at LOCALDOMAIN
        renew until 04/11/17 22:38:57

$ ipptool -v -t ipp://print-server.localdomain:80/printers/Queue/.printer get-completed-jobs.test
"/usr/share/cups/ipptool/get-completed-jobs.test":
    Get-Jobs:
        attributes-charset (charset) = utf-8
        attributes-natural-language (naturalLanguage) = en
        printer-uri (uri) = ipp://print-server.localdomain:80/printers/Queue/.printer
        which-jobs (keyword) = completed
        requested-attributes (1setOf keyword) = job-id,job-state,job-state-reasons,job-name,job-originating-user-name,job-media-sheets-completed
    Get completed jobs                                                   [FAIL]
        RECEIVED: 0 bytes in response
        status-code = client-error-not-authenticated (Unauthorized)
        IPP request failed with status client-error-not-authenticated (Unauthorized)

Any ideas what the problem might be here, or how I might go about debugging this problem further?

Regards,

Robert.