Mailinglist Archive: opensuse-features (120 mails)

< Previous Next >
[openFATE 313108] Kerberos printing via CUPS for openSUSE clients in a Windows AD domain
Feature changed by: Anderson Luiz Perazzoli (alperazzoli)
Feature #313108, revision 2
Title: Kerberos printing via CUPS for openSUSE clients in a Windows AD

- openFATE: Unconfirmed
+ openSUSE Distribution: Unconfirmed
Requester: Desirable

Requested by: Anderson Luiz Perazzoli (alperazzoli)
Partner organization:

The current kerberos printing solution included with openSUSE 12.1 and
11.4 does not work with openSUSE clients logged into a Windows Active
Directory Domain. CUPS supports kerberos, but it has issues, at least
if the Windows Server version is 2003 or higher, "because the kerberos
tickets are to large for the CUPS buffer according to Michael Sweet,
the original CUPS developer." - CUPS
error_log just gave me a cryptic error message - "[Job 2] Backend
returned status 1 (failed)" so I had to do some research to actually
find out the real issue. There is a CUPS backend developed
independently which I will describe below. It has solved this issue out-
of-the box.

Test Case:
Just enter a Windows Active Directory domain and try to print to a
printer which requires AD authentication. It fails with the message
"[Job 2] Backend returned status 1 (failed)" in the cups error_log. The
job fails and printing is paused.

Use Case:
I have worked around this limitation by using cups-ksmb
(, which handles the Active
Directory kerberos tickets properly and as such has solved the printing
problem for me. The quick dirty way which worked for me was unpacking
the small .deb binary package provided by the project's github, and
manually copying the files to my system. The important parts seem to be
/usr/lib/cups/backend/ksmb and /etc/sudoers.d/99ksmb. It worked on the
first test run, although it would have been much more elegant to just
install an RPM from the official repo. With these files in their
rightful places, the CUPS web frontend now offered me a new network
printer type ("SAMBA + Kerberos"), which puts ksmb:// to the beginning
of the printer URI. From there you just have to input your AD printer's
address in the "//server/printer" format and it just works.
My suggestion is that this backend be packaged & included in the next
openSUSE releases.

Business case (Partner benefit): It solved an issue which I had for a couple of years and
might be others' cases too. It adds to openSUSE's interoperability
level which I am sure will be appreciated by those using AD networks
with mixed windows/linux clients.

openSUSE Feature:

< Previous Next >
List Navigation
This Thread