[New: openFATE 313108] Kerberos printing via CUPS for openSUSE clients in a Windows AD domain
Feature added by: Anderson Luiz Perazzoli (alperazzoli) Feature #313108, revision 1 Title: Kerberos printing via CUPS for openSUSE clients in a Windows AD domain openFATE: Unconfirmed Priority Requester: Desirable Requested by: Anderson Luiz Perazzoli (alperazzoli) Partner organization: openSUSE.org Description: The current kerberos printing solution included with openSUSE 12.1 and 11.4 does not work with openSUSE clients logged into a Windows Active Directory Domain. CUPS supports kerberos, but it has issues, at least if the Windows Server version is 2003 or higher, "because the kerberos tickets are to large for the CUPS buffer according to Michael Sweet, the original CUPS developer." - http://blog.ryanharter.com/?p=4 CUPS error_log just gave me a cryptic error message - "[Job 2] Backend returned status 1 (failed)" so I had to do some research to actually find out the real issue. There is a CUPS backend developed independently which I will describe below. It has solved this issue out-of-the box. Test Case: Just enter a Windows Active Directory domain and try to print to a printer which requires AD authentication. It fails with the message "[Job 2] Backend returned status 1 (failed)" in the cups error_log. The job fails and printing is paused. Use Case: I have worked around this limitation by using cups-ksmb (https://github.com/vchoi/cups-ksmb), which handles the Active Directory kerberos tickets properly and as such has solved the printing problem for me. The quick dirty way which worked for me was unpacking the small .deb binary package provided by the project's github, and manually copying the files to my system. The important parts seem to be /usr/lib/cups/backend/ksmb and /etc/sudoers.d/99ksmb. It worked on the first test run, although it would have been much more elegant to just install an RPM from the official repo. With these files in their rightful places, the CUPS web frontend now offered me a new network printer type ("SAMBA + Kerberos"), which puts ksmb:// to the beginning of the printer URI. From there you just have to input your AD printer's address in the "//server/printer" format and it just works. My suggestion is that this backend be packaged & included in the next openSUSE releases. Business case (Partner benefit): openSUSE.org: It solved an issue which I had for a couple of years and might be others' cases too. It adds to openSUSE's interoperability level which I am sure will be appreciated by those using AD networks with mixed windows/linux clients. -- openSUSE Feature: https://features.opensuse.org/313108
Feature changed by: Anderson Luiz Perazzoli (alperazzoli) Feature #313108, revision 2 Title: Kerberos printing via CUPS for openSUSE clients in a Windows AD domain - openFATE: Unconfirmed + openSUSE Distribution: Unconfirmed Priority Requester: Desirable Requested by: Anderson Luiz Perazzoli (alperazzoli) Partner organization: openSUSE.org Description: The current kerberos printing solution included with openSUSE 12.1 and 11.4 does not work with openSUSE clients logged into a Windows Active Directory Domain. CUPS supports kerberos, but it has issues, at least if the Windows Server version is 2003 or higher, "because the kerberos tickets are to large for the CUPS buffer according to Michael Sweet, the original CUPS developer." - http://blog.ryanharter.com/?p=4 CUPS error_log just gave me a cryptic error message - "[Job 2] Backend returned status 1 (failed)" so I had to do some research to actually find out the real issue. There is a CUPS backend developed independently which I will describe below. It has solved this issue out- of-the box. Test Case: Just enter a Windows Active Directory domain and try to print to a printer which requires AD authentication. It fails with the message "[Job 2] Backend returned status 1 (failed)" in the cups error_log. The job fails and printing is paused. Use Case: I have worked around this limitation by using cups-ksmb (https://github.com/vchoi/cups-ksmb), which handles the Active Directory kerberos tickets properly and as such has solved the printing problem for me. The quick dirty way which worked for me was unpacking the small .deb binary package provided by the project's github, and manually copying the files to my system. The important parts seem to be /usr/lib/cups/backend/ksmb and /etc/sudoers.d/99ksmb. It worked on the first test run, although it would have been much more elegant to just install an RPM from the official repo. With these files in their rightful places, the CUPS web frontend now offered me a new network printer type ("SAMBA + Kerberos"), which puts ksmb:// to the beginning of the printer URI. From there you just have to input your AD printer's address in the "//server/printer" format and it just works. My suggestion is that this backend be packaged & included in the next openSUSE releases. Business case (Partner benefit): openSUSE.org: It solved an issue which I had for a couple of years and might be others' cases too. It adds to openSUSE's interoperability level which I am sure will be appreciated by those using AD networks with mixed windows/linux clients. -- openSUSE Feature: https://features.opensuse.org/313108
Feature changed by: Johannes Meixner (jsmeix) Feature #313108, revision 3 Title: Kerberos printing via CUPS for openSUSE clients in a Windows AD domain openSUSE Distribution: Unconfirmed Priority Requester: Desirable Requested by: Anderson Luiz Perazzoli (alperazzoli) Partner organization: openSUSE.org Description: The current kerberos printing solution included with openSUSE 12.1 and 11.4 does not work with openSUSE clients logged into a Windows Active Directory Domain. CUPS supports kerberos, but it has issues, at least if the Windows Server version is 2003 or higher, "because the kerberos tickets are to large for the CUPS buffer according to Michael Sweet, the original CUPS developer." - http://blog.ryanharter.com/?p=4 CUPS error_log just gave me a cryptic error message - "[Job 2] Backend returned status 1 (failed)" so I had to do some research to actually find out the real issue. There is a CUPS backend developed independently which I will describe below. It has solved this issue out- of-the box. Test Case: Just enter a Windows Active Directory domain and try to print to a printer which requires AD authentication. It fails with the message "[Job 2] Backend returned status 1 (failed)" in the cups error_log. The job fails and printing is paused. Use Case: I have worked around this limitation by using cups-ksmb (https://github.com/vchoi/cups-ksmb), which handles the Active Directory kerberos tickets properly and as such has solved the printing problem for me. The quick dirty way which worked for me was unpacking the small .deb binary package provided by the project's github, and manually copying the files to my system. The important parts seem to be /usr/lib/cups/backend/ksmb and /etc/sudoers.d/99ksmb. It worked on the first test run, although it would have been much more elegant to just install an RPM from the official repo. With these files in their rightful places, the CUPS web frontend now offered me a new network printer type ("SAMBA + Kerberos"), which puts ksmb:// to the beginning of the printer URI. From there you just have to input your AD printer's address in the "//server/printer" format and it just works. My suggestion is that this backend be packaged & included in the next openSUSE releases. Business case (Partner benefit): openSUSE.org: It solved an issue which I had for a couple of years and might be others' cases too. It adds to openSUSE's interoperability level which I am sure will be appreciated by those using AD networks with mixed windows/linux clients. + Discussion: + #1: Johannes Meixner (jsmeix) (2012-02-22 11:11:47) + I am neither a Kerberos nor an AD expert but as far as I understand the + ksmb bash script + https://github.com/vchoi/cups-ksmb/blob/master/ksmb + (https://github.com/vchoi/cups-ksmb/blob/master/ksmb) it seems it does + basically the same as our package "samba-krb-printing" does: + On the host where the CUPS backend runs it gets the Kerberos ticket + from the ticket cache of the user who had submitted the print job. + Regarding samba-krb-printing see + https://bugzilla.novell.com/show_bug.cgi?id=661845 + (https://bugzilla.novell.com/show_bug.cgi?id=661845) and why it + currently does not work and for a workaround see + https://bugzilla.novell.com/show_bug.cgi?id=685093 + (https://bugzilla.novell.com/show_bug.cgi?id=685093) + I think there is no need for one more such backend (i.e. no need for + ksmb) + I think it would be sufficient when samba-krb-printing is fixed. -- openSUSE Feature: https://features.opensuse.org/313108
participants (1)
-
fate_noreply＠suse.de