[cups] CUPS won't send my user name to the printer

Mon Sep 10 21:15:49 PDT 2018

Hi Gernot 

Thanks for your very detailed reply, which I have just read through. Very interesting. I'm not sure if I understand all of it, but I'll read it a few more times and see if I can make it work in CentOS7.

If this is what it takes to get it working under Linux, no wonder the staff at Fuji Xerox don't want to get involved!

Best regards

ian

> Back in 2012 I got this to work on a Xerox C4405 at my work, using the
below method. Maybe it will work for you too.
Mails were exchanged offline with Matt Broughton, unfortunately, I had
thought it was on the gutenprint or CUPS list.
So below is a summary, hopefully complete, for reference.

A. Background and tests done on Windows XP jobs

The device is a Fuji Xerox ApeosPort III C4405 machine with user
authentication (in my case it is just the 3-digit number on my work ID
card).

I have downloaded the (rather old) linux drivers called
fxlinuxprint-1.0.4-1.i386.rpm which installed fine on my x86_64 system
and could be found in CUPS.
Unfortunately, I am not able to print test pages with IPP or HTTP
print queue is incorreclty specified but I could set up HPJetDirect
fine.
Since I know the IP address of the printer, I used simply
socket://<ipaddress>:9100
The printer responds with a couple of beeps and the display there
shows "authentication needed". So I feel comfortable that the network
is OK.

So, on to the user authentication:

1) I noticed your discussion regarding user authentication for Ricoh
machines here:
https://discussions.apple.com/thread/2573454?start=0&tstart=0

2) Here is another discussion I found:
http://forums.linuxmint.com/viewtopic.php?f=49&t=41244

I understand that these commands might be different for different
companies, so I suppose without capturing a job it is difficult to say
what exactly is needed.
In 1) above, you seem to be saying you input an embedded script into
the PPD which then outputs the PJL into the printjob. Whereas in 2),
it seems a custom print filter is written to output the PJL and add
them to the printjob. I guess either way would work.

I would have to log into another Windows desktop that I need to get
authorization for, set up the printer driver there and try and capture
a small job to see what PJL commands (in hex I presume) are sent to
the printer.

Regarding the C4405,
It also has emulation for: ART IV, ESC/P(VP-1000), BMLinkS®, PDF、XPS,
DocuWorks, TIFF, JPEG
And as option kit, emulation for: PC-PR201H, HP-GL(HP7586B),
HP-GL2/RTL(HP Design Jet750C Plus), PCL5/PCL6

However, I could ascertain that the only information sent is the
UserID as a 3-digit number, in plain text, and UserName and Password
are blank.
There is apparently no authentication related to Windows Domains or
other login criteria.

Well, as it stands, I have tested sending a PS job from Windows XP
(installed as a VM inside CentOS on the Mac) with my card number in
the UserID setting in the driver setup. The printjob got sent, but the
printer reported that I need to get an authorization card set up. So
authentication fails.

I have managed just now to get someone to print a test job for me to a
file, and email it to me. So now I looked at the job in a hex editor,
and sure enough, there are PJL entries at the start of the print job,
with username, machine name, and userID, among all the other PJL items
there.

It seems therefore that I should be able to set the requisite items in
the Windows ART EX driver also, and if that works, try it with the
Windows postscript driver. Finally, if that works, I will try to input
the PJL statements into the linux postscript job somehow.

B. Manual fix and confirmed printing

As I managed to get a test print, I could compare the lines of PJL
with my current Windows setup to determine which fields I need to
fill.

After analysing the PJL items to determine which ones needed to be set
(depending on the driver version and authentication options, the items
in the GUI actually ended up either in different PJL statements of the
same sub-set, or as completely different PJL statements), I could
print from Windows successfully, using the ART EX driver.

Then, I attempted to do the same with the postscript Windows driver.
To no avail. The C4405 apparently lacks the PostScript kit, so it
cannot handle PS. So from Windows it prints only with the ART EX
driver (language name is apparently PWL). Even printing from Adobe
Reader converts into this.

I saw though that the C4405 does emulation of several languages (more
with the optional kit), among them PDF. And the linux driver printjob,
as I discovered below, is in fact PDF format.

Here again the full list of emulated languages:
ART IV
ESC/P(VP-1000)
BMLinkS®
PDF
XPS
DocuWorks
TIFF
JPEG

So, I connected the FX linux driver to a file output in CUPS (under
Ubuntu, as I use for gutenprint development) and tried to set the
authentication using the fxlputil program (which I could not get to
run on 64-bit OS). However, looking at the print job shows that this
only offers "secure printing" where one goes to the printer console
afterwards and enters a password per printjob. There is no support for
authentication.

So I edited the hex file in insert mode, adding the (possibly) 4
necessary PJL statements:
@PJL SET JOBATTR="@CNAM=arbitrary_name_of_PC" <= not required: name of
machine printed from.
@PJL SET JOBATTR="@DAID=" <= required: no entry
@PJL SET JOBATTR="@LUNA=ha4h-grnt"  <= required: local user name
@PJL SET JOBATTR="@JOAU=977" <= required: ID card number

Then I sent the printjob raw from the original CentOS5 64-bit machine,
using the installed FX driver for linux:

lpr -o raw -PC4405 printjob.prn

Viola!

So now I need to create a filter to add the PJL statements to the
printjobs created by the FX CUPS driver, just like is shown on this
page:
http://forums.linuxmint.com/viewtopic.php?f=49&t=41244

Very satisfying to be able to print to this device: and it means I
guess that one might be able to create a PPD without the FX drivers
perhaps, as long as the output is in PDF format  (and presumably
various PJL statements are set up).

C. Final setup

I've finally gotten everything sorted out, did not get it done at work
but finalized it at home on a Debian system. So below is how to get
such authentication working on DocuCenter and ApeosPort machines. Of
course, depending on the authentication options, the required PJL
statements and their contents will be different, and the same can be
done for so-called "secure printing" is one does not wish to use the
fxlputil program Fuji Xerox provide that inputs the requisite
statements for secure printing (password required from printer console
to print the job, in addition to authentication).

Issue:
======
Trying to get the C4405 to print from linux. Port settings and driver
installation worked smoothly via CUPS (socket, port 9100).
For authentication, need following PJL "JOBATTR SET" statements in the
PJL header of the print job.

@PJL SET JOBATTR="@CNAM=XXXXXX"
@PJL SET JOBATTR="@DAID="
@PJL SET JOBATTR="@JOAU=NNN"
@PJL SET JOBATTR="@LUNA=xxxx-xxxx"

Notes:
@CNAM is the name of the PC (anything is OK)
@DAID must be empty
@JOAU must be numeric security card ID number
@LUNA must be set to company Windows login name in small letters

References:
===========
PDF emulation supported, so the Fuji Xerox-supplied linux filter
actually works, only the above must be added for authentication,
using as a starting point the example provided in:
http://forums.linuxmint.com/viewtopic.php?f=49&t=41244

How to add additional stages to CUPS filter.
http://en.opensuse.org/SDB:Using_Your_Own_Filters_to_Print_with_CUPS

C4405 specs:
http://www.fujixerox.co.jp/product/multifunction/ap3_c4405/spec.html

Latest linux driver:
http://www.fujixerox.co.jp/download/apeosport/download/c4300series/linux/

Latest linux FX print utils (not needed, does not run on x86_64
systems owing to Tcl issues):
http://www.fujixerox.co.jp/download/apeosport/download/
c4300series/linux_utility/

Procedure:
==========
Installed files (by FX driver):

/etc/cups/mimefx.types
 contains:
 application/vnd.cups-pdfprintfx

Notes: mime.types and mimefx.types define known formats to be
converted to, in this case the new type
application/vnd.cups-pdfprintfx. A similar filter already existing in
mime.types defines application/vnd.cups-postscript.

/etc/cups/mimefx.convs
 contains:
 application/pdf application/vnd.cups-pdfprintfx 0       pdftopdffx

Notes: mime.convs and mimefx.convs control conversion *to* a common
format, in this case the application/vnd.cups-pdfprintfx format. A
similar filter already existing in mime.convs converts
application/postscript to application/vnd.cups-postscript.
But for Debian mime.convs had this commented out.

/usr/share/cups/model/FujiXerox/fxlinuxprint.ppd.gz
 contains:
 *cupsFilter:    "application/vnd.cups-pdfprintfx 0 pdftopjlfx"
 *cupsFilter:    "application/vnd.cups-postscript 0 pstopdffx"

Notes: this indicates the last filter run on the printjob before it is
passed to the backend. Hence if we append a filter, we need to create
a new MIME type, remove the last filter to somewhere else, and add the
new appended filter here.

Hence, it appears that PDF formats are converted to pjlfx, whereas
postscript are converted to pdffx. I am not sure how the pstopdffx
filter is supposted to work---does it output the result straight to
the printer, or output something in application/vnc.cups-pdfprintfx
format that the previous line then acts on?

/usr/lib/cups/filter/pstopdffx
/usr/lib/cups/filter/pdftopdffx
/usr/lib/cups/filter/pdftopjlfx

instance PPD will be put in:
/etc/cups/ppd/

What we want to do (for PDF):
application/pdf -> application/vnd.cups-pdfprintfx (pdftopdffx in
mimefx.convs)
application/vnd.cups-pdfprintfx -> application/vnd.cups-pjlprintfx
(pdftopjlfx in mimefx.convs)
application/vnd.cups-pjlprintfx -> straight to backnd (fxauth in PPD)

Step 1: Add line to mimefx.types
 application/vnd.cups-pjlprintfx

Step 2: Add to line mimefx.convs
 application/vnd.cups-pdfprintfx application/vnd.cups-pjlprintfx 0
  pdftopjlfx

Step 2a: For Debian, uncomment in /usr/share/cups/mime/mime.convs
 application/pdf                 application/vnd.cups-postscript 66
pdftops

Notes: why everything except postscript is commented out I do not
know. But that way, printing a PDF file from the command line results
in an error that application/pdf is not supported. When uncommented,
CUPS correctly prepares the filter chain pdftopdffx, pdftopljfx,
fxauth, i.e., not using the pdftops at all. Very odd.

For PS, CUPS first runs ghostscript with the pdfwrite device,
converting the PS input file to PDF (pstopdf). Then the filterchain
pdftopdffx, pdftopljfx, fxauth is called as before.

No workaround is needed for CentOS5 (I think).

Step 3: Replace in PPD (either original one before installing printer,
or in local instance after installing printer).
 Before: *cupsFilter:    "application/vnd.cups-pdfprintfx 0 pdftopjlfx"
 After : *cupsFilter:    "application/vnd.cups-pjlprintfx 0 fxauth"

Step 4: Add fxauth filter to CUPS
  Copy fxauth to directory /usr/lib/cups/filter/
  Contents:
---BEGIN---
#!/bin/bash

[ -n "$6" ] && exec <"$6"
# input is regular file
cleanup() { EXIT_CODE=$? ; rm -f $INPUT &>/dev/null ; exit $EXIT_CODE ; }
trap 'cleanup' 0 1 2 3 15

MY_NAME=${0##*/}
INPUT=$( mktemp /var/spool/cups/tmp/$MY_NAME.XXXXXX ) || exit 1
cat - >$INPUT

# prefilter for all printjobs arriving on linux, since authentication
is not optional

source /etc/cups/ppd/${PRINTER}.fx

sed -e '/@PJL COMMENT Version:4.00/ a\
@PJL SET JOBATTR='\"${FX_MACHINE_NAME}\"'\
@PJL SET JOBATTR='\"${FX_AUTH_ID}\"'\
@PJL SET JOBATTR='\"${FX_LOCAL_USER}\"'\
@PJL SET JOBATTR='\"${FX_CARD_NUMBER}\" $INPUT

exit $?
---END---

Step 5: Add PJL command list file
  Copy C4405.fx to /etc/cups/ppd/
  Note: use the printer name instead of C4405. The contents of this
file contain the variables that are inserted with the fxauth filter.
  Comments could be added to C4405.fx. For example, @CNAM is required,
but variable can be anything. @DAID must be empty. @JOAU must be the
security card number. @LUNA must be the company login user name in
small letters.
  Contents:
---BEGIN---
FX_MACHINE_NAME="@CNAM=XXXX"
FX_AUTH_ID="@DAID="
FX_CARD_NUMBER="@JOAU=NNN"
FX_LOCAL_USER="@LUNA=xxxx-xxxx"
---END---

Step 6: reload or restart CUPS
/etc/init.d/cups reload
or
/etc/init.d/cups restart

D. Addendum on old CentOS

There was one issue though. For CentOS, this did not work. The reason,
as I perceive it, is that CentOS5 (with CUPS 1.3.7) still uses
PostScript for the workflow, and I had to use the following lines in
the mimefx.convs, instead of just one line as for Debian/Ubuntu. So I
basically wrote out the entire workflow from PostScript to the final
PDF with PJL commands. I don't know why the normal mime.convs line
converting from postscript to PDF did not come into effect, I copied
them (the first two lines) to mimefx.convs and they do the job. Maybe
something to do with the weighting of the filters. In any case, this
is the only difference to the Debian/Ubuntu systems, where
mimefx.convs only needs to be one line (as given in my previous
explanation, down below).

application/postscript application/vnd.cups-postscript 0 pstops
application/vnd.cups-postscript application/vnd.cups-pdf 0 pstopdf
application/vnd.cups-pdf        application/vnd.cups-pdfprintfx 0 pdftopdffx
application/vnd.cups-pdfprintfx application/vnd.cups-pjlprintfx 0 pdftopjlfx

Hope this gives some insight historically, since I don't know how current
any of this is at this stage.
Best regards,
Gernot Hassenpflug
_______________________________________________
cups mailing list
cups at cups.org
https://lists.cups.org/mailman/listinfo/cups