Bug 497620

Summary: `Satisfy any' doesn't work for Print-Job operations
Product: Red Hat Enterprise Linux 5 Reporter: Opher Shachar <ophers>
Component: cupsAssignee: Tim Waugh <twaugh>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE <qe-baseos-auto>
Severity: high Docs Contact:
Priority: low    
Version: 5.3   
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-04-27 12:05:29 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Opher Shachar 2009-04-25 07:15:38 UTC 
Description of problem:
Our production system is running app servers on RHEL 4.4 and print servers on RHEL 5.2 .
In our production installation we have our application servers and print servers in one network subnet.
We configured our print server to require authentication - for any kind of access - from client machines (residing outside the `server' network subnet), but no authentication for printing or querying.
This was configured simply by introducing this in cupsd.conf:

    <Location />
    Order allow,deny
    Allow localhost
    Allow @LOCAL
    Satisfy any
    AuthType basic
    Require valid-user
    </Location>

When upgrading (a test system) the print sever to RHEL 5.3 (with cups 1.3.7-8) this no longer works as expected. Submitting print jobs from an app server, ex:

    lp -h printserver -d Printer1 printfile.ps

would prompt for a password.
Query operations from an app server, on the other hand, ex:

    lpstat -h printserver -p Printer1

does behave as expected and doesn't ask for a password.

There is STR #2782 upstream that reports and solves this issue.
I patched the current cups-1.3.7-8 and it works.

Version-Release number of selected component (if applicable):
cups 1.3.7-8

How reproducible:
Always

Steps to Reproduce:
On a print server do 1,2:
1. Add this to cupsd.conf:
    <Location />
    Order allow,deny
    Allow localhost
    Allow @LOCAL
    Satisfy any
    AuthType basic
    Require valid-user
    </Location>

2. add a printer:
    lpadmin -p Printer1 -m raw -v file:/dev/null -E

3. From a machine in the same network segement:
    lp -h print-server -d Printer1 printfile.ps

4. or even from the print server itself (as far as I remember)
    lp -h localhost -d Printer1 printfile.ps
  
Actual results:
in steps 3 and 4 you are prompted for a password.

Expected results:
job submission is accepted with no authentication.

Additional info:
This is fixed upstream by STR #2782.
I've patched cups-1.3.7-8 with the fix and tested - it works.
Comment 1 Tim Waugh 2009-04-27 12:05:29 UTC 

*** This bug has been marked as a duplicate of bug 481303 ***