Authentication to CUPS from kprinter

[Helge Hansemann]

Kurt Pfeifle wrote:
> On Tuesday 12 September 2006 11:29, Helge Hansemann wrote:
>   
>> Kurt Pfeifle wrote:
>>     
>>> On Tuesday 12 September 2006 08:42, Helge Hansemann wrote:
>>>       
>
>   
>>> Which version of KDE is that?
>>>   
>>>       
>> KDE-Version:  3.4.2 Level "b"
>>     
>
> KDE 3.4.2 may have problems authenticating to a CUPS 1.2.x server,
> to be honest.
>
> Just look at
>
>     http://bugs.kde.org/show_bug.cgi?id=115891
>     http://bugs.kde.org/show_bug.cgi?id=124157
>
> and a few other KDEPrint problems that popped up when CUPS 1.2.0 was 
> released:
>
>     http://www.kdedevelopers.org/node/1901
>
> [....]
>   
All right, I will have a closer look to them tomorrow.
>>> Please do also post the complete contents of
>>>
>>>   $(kde-config --localprefix)/share/config/kdeprintrc
>>>   $(kde-config --localprefix)/share/config/kprinterrc
>>>   /etc/cups/client.conf    # leave out the comment lines
>>>   $HOME/.cupsrc            # leave out the comment lines
>>>   $HOME/.cups/client.conf  # leave out the comment lines
>>>
>>> (Some of these files may not exist on your system)
>>>   
>>>       
>> ---------------
>>
>> UserA at ClientA:/etc/ssl/certs> cat /home/UserA/.kde/share/config/kdeprintrc
>> [$Version]
>> update_info=kdeprintrc.upd:kde-3.1-toolbar
>>
>> [CUPS]
>> Host=ServerA
>> InstallDir=
>> Login=UserA
>> Port=631
>>     
>
> Well, this last line tells kprinter to access the CUPS server via 
> port 631, and *not* via 443 as you stated....
>
>   
Yes, I tried both and sent you the latest testing configurations.
>> SavePassword=false
>>     
>
> You should try with a setup that saves the password. Access it via the
> "System Options"-button of kprinter. That will lead to include the 
> following statements in kdeprintrc:
>
>   [CUPS]
>   Host=ServerA
>   InstallDir=
>   Login=UserA
>   Port=631
>   Password=[whatever_will_be_written_here_(encrypted)]
>   SavePassword=false
>
>   
I did, and the result looks like this:
The Password Line is not existent, and, if I put one by hand, it is
deleted after closing kprinter - maybe a hint?

UserA at HostA:~> cat /home/UserA/.kde/share/config/kdeprintrc
[$Version]
update_info=kdeprintrc.upd:kde-3.1-toolbar

[CUPS]
Host=IP-ServerA
InstallDir=
Login=UserA
Port=443
SavePassword=false

[Filter]
LocationRe=
Printers=

[General]
ExternalPreview=false
PreviewCommand=gv
ShowStatusMsg=true
TestPage=
TimerDelay=5
UseLast=true
ViewType=2

[Jobs]
Limit=0
Size=550,250

> Also, please check your server's cupsd.conf. Do you have 2 different 
> "Listen" statements included there, where one is naming a Unix Domain 
> Socket (file) [domain socket support was newly introduced with CUPS 
> 1.2.0], the other one a TCP/IP socket. Try to move the domain socket 
> *below* all other "Listen" or "Port" statements.
>
> So what's the output of
>
>   grep -v ^# /etc/cups/cupsd.conf | grep -v ^$
>
>   
Here it comes, I deleted the Port line "Port 631", which was before the
SSLPort line - (results in a failing cancel command on the command line,
cause Port 631 is not accessible)

(By the way, if I comment out the two authentication lines in the
"cancel-Job" policy section, it works)

(in my system its in /usr/local/cups/etc/cups/cupsd.conf.default)

LogLevel debug2
SystemGroup sys root
SSLPort 443
Browsing On
BrowseOrder allow,deny
BrowseAllow @LOCAL
BrowseAllow IP-HostA
DefaultAuthType Basic
<Location />
  Order allow,deny
  Allow localhost
  Allow IP-ClientA
</Location>
<Location /admin>
  Encryption Required
  AuthType Basic
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
  Allow IP-ClientA
</Location>
<Location /admin/conf>
  AuthType Basic
  Require user @SYSTEM
  Order allow,deny
  Allow localhost
  Allow IP-ClientA
</Location>
<Policy default>
  # Job-related operations must be done by the owner or an adminstrator...
  <Limit Send-Document Send-URI Hold-Job Release-Job Restart-Job
Purge-Jobs Set-Job-Attributes Create-Job-Subscription Renew-Subscription
Cancel-Subscription Get-Notifications Reprocess-Job Cancel-Current-Job
Suspend-Current-Job Resume-Job CUPS-Move-Job>
    AuthType Basic
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  # All administration operations require an adminstrator to authenticate...
  <Limit Pause-Printer Resume-Printer Set-Printer-Attributes
Enable-Printer Disable-Printer Pause-Printer-After-Current-Job
Hold-New-Jobs Release-Held-New-Jobs Deactivate-Printer Activate-Printer
Restart-Printer Shutdown-Printer Startup-Printer Promote-Job
Schedule-Job-After CUPS-Add-Printer CUPS-Delete-Printer CUPS-Add-Class
CUPS-Delete-Class CUPS-Accept-Jobs CUPS-Reject-Jobs CUPS-Set-Default>
    AuthType Basic
    Require user @SYSTEM
    Order deny,allow
  </Limit>
  # Only the owner or an administrator can cancel or authenticate a job...
  <Limit Cancel-Job CUPS-Authenticate-Job>
    AuthType Basic
    Require user @OWNER @SYSTEM
    Order deny,allow
  </Limit>
  <Limit All>
    Order deny,allow
  </Limit>
</Policy>


Thanks !


-- 
Helge Hansemann
Leibniz Rechenzentrum

Boltzmannstrasse 1
85748 Garching
Tel. 089 35831 8789