[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
If this is not fixed, the attached config also breaks any cups package updates as the package scripts get the authentication prompt and hang. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Actually it looks this is probably a bit different than the original issue in this bug, sorry about that. However, I have attached our cupsd.conf and any printers we are using have "OpPolicy authenticated". With this config (the difference to stock Ubuntu config is AuthType Default for /), for example lpstat -a always prompts for credentials. In xenial and cosmic this works without prompting through PeerCred. With the attached config, even root is asked for credentials for 'lpstat -a'. After applying both of the patches you found upstream (which were combined in my earlier diff) this works without prompting as it should and the AUTH_UID is passed correctly. You can also see one of the symptoms of this problem in the original bug report as AUTH_UID is not set in the original post. Even with the Kerberos authentication failing, when using the socket cups should have set the AUTH_UID properly. ** Attachment added: "cupsd.conf" https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+attachment/5242616/+files/cupsd.conf -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
@Esko, could you describe the setup enough so the description can be used for a SRU (https://wiki.ubuntu.com/StableReleaseUpdates)? Looking to the upstream commits and your diff, it looks like that one might be the one fixing your issue https://github.com/apple/cups/commit/1f679daf and the third line changed is https://github.com/apple/cups/commit/b643d6ba -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
We had very similar symptoms (the user always gets a username/password prompt when trying to print) but it seems for us PeerCred was not working properly. I tried compiling the source tree from cosmic and it worked correctly. I then took a diff between that and the bionic package and the cups/auth.c has 3 different lines. Applying this patch to the 2.2.7 source tree fixes the issue at least for us. ** Patch added: "fix-password-prompt.patch" https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+attachment/5242599/+files/fix-password-prompt.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Upstream referenced to a commit that could fix the issue https://github.com/apple/cups/commit/ef2f369c -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
** Changed in: cups Status: Unknown => Fix Released -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Reported upstream as https://github.com/apple/cups/issues/5536. ** Bug watch added: github.com/apple/cups/issues #5536 https://github.com/apple/cups/issues/5536 ** Also affects: cups via https://github.com/apple/cups/issues/5536 Importance: Unknown Status: Unknown -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Ideally that would be reported upstream, Till maybe you can help with that? ** Changed in: cups (Ubuntu) Assignee: (unassigned) => Till Kamppeter (till-kamppeter) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
To get kerberos authentication fixed again in CUPS would be extremely good! I guess downgrading to SMB1 is not even an option in many bigger and/or more open environments -- typically managed by someone else with security oriented attitude. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
I found the solution: https://www.dedoimedo.com/computers/ubuntu-beaver-samba-shares.html Quote: The reason is, they changed the default protocol version and whatnot, and actually, who cares. People just want to be able to share things with their Windows boxes easily! Edit /etc/samba/smb.conf Add a line client max protocol = NT1 Restart smb sudo systemctl restart smbd.service Now we can see the windows neighbours and the share printers. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Status changed to 'Confirmed' because the bug affects multiple users. ** Changed in: cups (Ubuntu) Status: New => Confirmed -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Unfortunately my possible workaround in comments 3 & 4 only partially work - cups stops prompting for a password but its smb backend (/usr/lib/x86_64-linux-gnu/samba/smbspool_krb5_wrapper) does not receive the AUTH_UID is not set and therefore cannot spool the job the a Windows print server. I'm assuming that AUTH_UID can only be set if using a domain socket connection rather than a localhost connection to the cups daemon. The patch I propose in comment 5 does appear to work. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
The attachment "proposed_solution.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team. [This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.] ** Tags added: patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
Here is my proposed solution (attached) to the problem - I do not claim to fully understand cups' authentication system but it seems to me from looking at the old code to cups/auth.c and the new broken code that this patch would make the unix domain socket authentication work the same as it did before: ** Patch added: "proposed_solution.patch" https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+attachment/5170387/+files/proposed_solution.patch -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
My suggested work around above does not fix the issue (completely) because systemd is in charge of the socket - so as well as commenting out "Listen /run/cups/cups.sock" in /etc/cups/cupsd.conf you have to also do the following: systemctl stop cups.service systemctl stop cups.socket rm /run/cups/cups.sock systemctl disable cups.socket systemctl start cups.service -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
It appears that it first stops working in cups version 2.2.7 when there is a major change in cups/auth.c. It is still broken in the current cups github repo master branch. I have noticed it works correctly if you disable the unix domain socket, e.g. comment out Listen /run/cups/cups.sock in /etc/cups/cupsd.conf -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
[Bug 1783298] Re: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work
The above setup work fine in Ubuntu 17.10 as well which uses cups 2.2.4 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1783298 Title: AuthInfoRequired negotiate in cups 2.2.7 in Bionic does not work To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/cups/+bug/1783298/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
