Description of problem:

We are printing to a kerberos-authenticated samba queue, which is configured with "AuthInfoRequired negotiate". Under unclear circumstances it has on its own reset to "AuthInfoRequired username,password", which has broken Kerberos authentication and caused credentials to be prompted for.

For historical reasons we are using our own wrapper script instead of the samba-krb5-printing package, but as this too is just a wrapper to smbspool, the chances are that it is not just our problem.

I was going though the sources in search for clues of what is going on and I think I may have found an unintended consequence. I'm not entirely sure if I should file this under cups or samba, but I picked cups because I think it is rather surprising that it allows a single job to reconfigure the authentication method of a system printer as it does in cups-1.6.3/scheduler/job.c, function update_job():

      if ((attr = cupsGetOption("auth-info-required", num_attrs,
                                attrs)) != NULL)
      {
        cupsdSetAuthInfoRequired(job->printer, attr, NULL);
        cupsdSetPrinterAttrs(job->printer);

        cupsdMarkDirty(CUPSD_DIRTY_PRINTERS);
      }

This is cups parsing a message received from the backend through stderr. In the case of the smbspool backend, this message can be written in samba-4.8.3/source3/client/smbspool.c function get_exit_code(). If the function happened to be  called with use_kerberos==false, attr will read "username,password" and cups will react by reconfiguring it into the printers AuthInfoRequired.

get_exit_code() appears to be called from several places of smbspool.c, some with a hardcoded use_kerberos==false, but the logic in smb_connect() looks interesting already: kerberos authentication is attempted if use_kerberos==true, but if it fails fails for any reason, fallbacks without kerberos are attempted.

And if a fallback fails for one of 12 reasons, including the wrong password given, "ATTR: auth-info-required=username,password" gets written by the backend and cups responds by reconfiguring the printer to never try Kerberos anymore.

So if I'm reading this right, it can go like this:

 1. User A runs kdestroy
 2. User A tries to print a web page, but fumbles his password when prompted.
 3. User B can no longer print with Kerberos authentication.


Version-Release number of selected component (if applicable):

cups-1.6.3-35.el7.x86_64
samba-client-4.8.3-4.el7.x86_64