The CUPS gui, I'm afraid, is no help, and hasn't improved from the
mess 10 years ago, described by Eric Raymond at
http://www.catb.org/esr/writings/cups-horror.html
Please identify what you're trying to accomplish with Kerberos. That
only certain people can use certain printers? Or that only authorized
people with Kerberos credentials can use the printers? Or that only
certain printers can be used without authorization? And does it need
to be AD or LDAP group membership, rather than just Kerberos
credentials, namely account management rather than mere
authentication?
On Sat, Mar 15, 2014 at 8:43 AM, Yvan Masson
<yvan.masson@openmailbox.org> wrote:
Hi everybody,
I installed around 30 Debian Wheezy computers in the school I work
for.
The network architecture is simple, with one Win 2003 Server acting as
domain controller, file server and print server.
My users on Debian can now authenticate against Active Directory,
access
shares and print.
My problem is that I didn't find the "good" way to print using
Kerberos
credentials : it seems that CUPS should be able to do it, but does not
(see for example
https://bugs.launchpad.net/ubuntu/+source/cups/+bug/788167), so you
have
to write a custom backend (for example
http://ubuntuforums.org/showthread.php?t=2176738, which is the one I
currently use).
The CUPS documentation is a bit short
(http://www.cups.org/documentation.php/doc-1.5/kerberos.html), and I
already spent dozens of hours on this, seeing that everybody facing
this
problem gives up or use a custom backend. I don't know if I should
report it as a bug to CUPS maintainers or a feature request to Samba
maintainers (maybe they could write a custom backend and distribute it
as a package, like samba-krb-printing for OpenSuse).
What do you think about this issue ? May I miss something important ?
Another reason I am giving headache on this is because I now that many
other schools I am in contact with are interested to use Linux
computers, and because my network architecture is really common : it
should work without hacking !
For people interested in, I wrote a procedure (in french) available at
http://unptitcoin.no-ip.org/index.php?article3/poste-de-travail-debian-7-integre-a-un-domaine-active-directory.
This version is very old but I will update it next week.
Thanks very much for reading and helping,
Yvan Masson
--
To UNSUBSCRIBE, email to debian-enterprise-request@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact
listmaster@lists.debian.org
Archive:
[🔎] 1394887392.11077.49.camel@MacBook-Yvan.home">https://lists.debian.org/[🔎] 1394887392.11077.49.camel@MacBook-Yvan.home