The Samba-Bugzilla – Bug 13970
Can no longer authenticate for Samba/CUPS printer (NT_STATUS_ACCESS_DENIED)
Last modified: 2019-11-29 13:39:18 UTC
Since updating to Samba 4.10.*, CUPS printers that require Samba authentication no longer work. Attempt to print results in the error `Session setup failed: NT_STATUS_ACCESS_DENIED`.
In addition, Samba modifies `/etc/cups/printer.conf` to add a new line: `AuthInfoRequired negotiate`. In my previous configuration, there was no line here previously, but others have reported Samba changing it from `AuthInfoRequired none` or from `AuthInfoRequired username,password`. 
If I revert samba, libwbclient, and smbclient to version 4.9.5, revert the line in /etc/cups/printer.conf, and restart CUPS, then I can print perfectly again.
I have performed a git bisect of samba, libwbclient, and smbclient collectively, with the following results:
r10 c6f1719b5e25984afc3168bdcd8efdb301108afd good
r11 84aad2ea7d53d8d7645bbd9e4c9ce6b09f6016c5 couldn't build
r12 755f624e2bbca22da44b9b9352aa095bc3603db3 bad
r11 will not build, and fails with:
+ install /build/samba-git/src/samba-pkg/usr/lib/samba/libdsdb-module-samba4.so (from bin/default/source4/dsdb/samdb/ldb_modules/libdsdb-module-samba4.inst.so)
Waf: Leaving directory `/build/samba-git/src/samba/bin/default'
Traceback (most recent call last):
File "/build/samba-git/src/samba/third_party/waf/waflib/Task.py", line 320, in process
ret = self.run()
File "/build/samba-git/src/samba/third_party/waf/waflib/Build.py", line 1101, in run
fun(x.abspath(), y.abspath(), x.path_from(launch_node))
File "/build/samba-git/src/samba/third_party/waf/waflib/Build.py", line 1168, in do_install
raise Errors.WafError('Could not install the file %r' % tgt, e)
WafError: Could not install the file '/build/samba-git/src/samba-pkg/usr/lib/python2.7/site-packages/samba/dcerpc/idmap.so'
make: *** [Makefile:10: install] Error 1
==> ERROR: A failure occurred in build().
==> ERROR: Build failed, check /var/lib/archbuild/extra-x86_64/username/build
I also tried the patch from bug 13939 , but this did not fix the problem. Several Arch users have reported this issue here .
(I apologise if I have selected the wrong fields for the bug.)
I've also tested samba 4.10.6, because this commit [a] might have fixed this problem. Unfortunately it's still broken, but in a different way.
I upgraded samba, libwbclient, and smbclient, then restarted cups. I try to print, and the printer is put on hold. At this point, `/etc/cups/printers.conf` is unmodified. I try and resume the printer, but it goes back on hold. `/etc/cups/printers.conf` is now modified again, with `AuthInfoRequired none` added. There is nothing obvious in the logs.
I tried changing this line to `AuthInfoRequired username,password`, substituting my username and password, then restarting cups. After attempting to resume the printer, it is again put on hold. Now I can see in `/var/log/cups/error_log` the following line:
Bad AuthInfoRequired on line 53 of printers.conf.
I try to resume, and `/etc/cups/printers.conf` is reverted to `AuthInfoRequired none`. I've tried to enter my password multiple times, so it's not in error. It's also the same password as in the `DeviceURI smb:///` line (which is used in the working samba 4.9.5), so I know it's correctly typed.