https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c2 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |NEW InfoProvider|samba-maintainers@SuSE.de | --- Comment #2 from Lars Müller 2011-01-04 12:02:56 CET --- As soon as you have a valid kerberos ticket granting ticket (TGT) you no longer need a password to authenticate. _If_ the targeted service is kerberized. Instead of adding any additional question like "Do you like to install the samba-krb-printing package?" to the YaST printing dialog we should consider to add a recommenrds samba-krb-printing to the samba-winbind package. The TGT you get with the initial authentication via the display manager. We've tested this with the one from Gnome and KDE. Therefore usually a further input of a password isn't required. get_printing_ticket uses the username as offered as second argument after the DEVICE_URI For testing you have to prompt for a username and password while in this particular case the username is a construct of The most common case for the winbind separator is the \ char. I would keep this as simple as possible and therefore only offer a username and password inout field. In the documentation to the username field we might offer an example like EXAMPLEDOM\joe I count the get_printing_ticket hack a superset but haven't tested this. The drawbacks are: This is hack and it's not upstream (well, this might change). As soon as the printer destination isn't the next hop (think of chained print servers) a forward able ticket would be required. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c4 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |rolf.schmidt@novell.com --- Comment #4 from Johannes Meixner 2011-01-04 11:51:58 UTC --- An explicit switch in yast2-printer for the user to install or uninstall samba-krb-printing has the advantage that it is fail-safe: If printing via the "smb" backend does no longer work after samba-krb-printing was installed, the user can switch back to the traditional method and vice versa. This way we may get only a few bug reports when it does not work by default "out of the box" but there are hopefully less bug reports that it "does not work at all" (e.g. only because samba-krb-printing was not installed). -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c5 --- Comment #5 from Lars Müller 2011-01-04 13:48:14 CET --- There is no further documentation. All we're able to offer are the comments from the source code: /* Usage: * * get_printing_ticket <smbspool cups args.> * * The cups args look like : * * [DEVICE_URI] job-id user title copies options [file] · * Sets its uid to the given username and then invokes smbspool. */ That's very likely or must even be identical to what you know from other back ends. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c7 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|ASSIGNED |RESOLVED Resolution| |FIXED Target Milestone|--- |Factory --- Comment #7 from Johannes Meixner 2011-01-13 08:27:41 UTC --- Implemented in yast2-printer 2.20.4 (already available via the "Printing" project) and submitted to openSUSE:Factory via submitrequest 57971 There is now a check box in the "connection wizard" dialog for SMB: [ ] Support for Windows Active Directory It is checked if the link /usr/lib[64]/cups/backend/smb points to /usr/bin/get_printing_ticket If the user checks it, yast2-printer tests if the package samba-krb-printing is installed and if not it tries to install it. If the user unchecks it, yast2-printer only lets the link /usr/lib[64]/cups/backend/smb point to its traditional target /usr/bin/smbspool but yast2-printer does not remove the samba-krb-printing packet. If the user likes to test the SMB connection when the check box is checked, yast2-printer shows a popup which reads: ---------------------------------------------------------------------------- This is only a generic test which may untruly report failures if authentication via Windows Active Directory is required. In this case a particular user who is allowed to print via Active Directory should log in and test by himself if he can print from Gnome or KDE. ---------------------------------------------------------------------------- The help text in yast2-printer is: ------------------------------------------------------------------------ By default CUPS runs backends (here smbspool) as user 'lp'. When printing in a Windows Active Directory (AD) environment the user 'lp' is not allowed to print in this environment so that the traditional way to print via smbspool as user 'lp' would not work. For printing in an AD environment additionally the RPM package samba-krb-printing must be installed. In this case the CUPS backend 'smb' link is changed to /usr/bin/get_printing_ticket which is a wrapper to run smbspool as the original user who submitted a particular print job. When the Kerberos protocol is used for authentication in an AD environment, a user gets a ticket granting ticket (TGT) via the display manager during login at the Gnome or KDE desktop. When smbspool is run as the original user who submitted a particular print job, it can access the TGT of this user and use it to pass the printing data to the SMB printer share even in an AD environment with Kerberos authentication. In this case neither a fixed user name nor a fixed password has to be specified for authentication. A precondition is that get_printing_ticket runs on the same host where the user who submitted a particular print job is logged in. This means that it must be set up on the workstation for the particular user who will submit such print jobs and the user's workstation must send its printing data directly to the SMB printer share in the AD environment. In particular it does not work on a separated CUPS server machine where users who submit print jobs are not logged in. ------------------------------------------------------------------------ Lars, does this look o.k. for you? -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c13 Lars Müller changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |NEEDINFO InfoProvider| |cfarrell@novell.com --- Comment #13 from Lars Müller 2011-01-13 15:42:14 CET --- @Ciaran: Please see comments 8 ff. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c16 --- Comment #16 from Johannes Meixner 2011-01-14 11:20:59 UTC --- Basically there are the following proper name questions: 1. Whether or not it is o.k. to use the plain word "Windows" in YaST help texts and YaST dialogs or must it be called "Microsoft Windows" in any case? 2. What is the right proper name of a thingy which is commonly called like "Windows Active Directory" or simply "AD"? 3. Must an official proper name used in any case? In particular also in YaST dialogs where the space is often very limited? E.g. a check box labeled like ------------------------------------------------------------------------------ [X] support for Microsoft Windows Server Active Directory Domain Services (tm) ------------------------------------------------------------------------------ would not fit inside the available space on a 80 characters wide ncurses YaST dialog because there are some frames around the check box widget so that the content of the check box label would be clipped. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c18 --- Comment #18 from Johannes Meixner 2011-01-18 14:46:34 UTC --- E.g. http://de.wikipedia.org/wiki/Windows reads (German only) ------------------------------------------------------------- Ursprünglich war "Microsoft Windows" eine grafische Erweiterung des Betriebssystems MS-DOS .. Inzwischen wurde dieser Entwicklungszweig zugunsten der Windows-NT-Produktlinie aufgegeben und "Windows" bezeichnet das Betriebssystem als Ganzes. ------------------------------------------------------------- This indicates that nowadays "Windows" is the right proper name when the "Windows" operating system is meant. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.

https://bugzilla.novell.com/show_bug.cgi?id=661845 https://bugzilla.novell.com/show_bug.cgi?id=661845#c20 Johannes Meixner changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEEDINFO |RESOLVED InfoProvider|cdenicolo@novell.com | Resolution| |FIXED --- Comment #20 from Johannes Meixner 2011-01-18 17:11:11 UTC --- Many Thanks for the info! I use now "Windows (R)" and "Active Directory (R)" according to http://www.microsoft.com/about/legal/en/us/IntellectualProperty/Trademarks/E... and added references to the trademark ownership as specified on http://www.microsoft.com/about/legal/en/us/IntellectualProperty/Trademarks/U... Submitted yast2-printer 2.20.4 to YaST:Head via submitrequest 58705 and forwarded this to openSUSE:Factory via submitrequest 58707 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.