Bug 13970 - Can no longer authenticate for Samba/CUPS printer (NT_STATUS_ACCESS_DENIED)
Can no longer authenticate for Samba/CUPS printer (NT_STATUS_ACCESS_DENIED)
Status: NEW
Product: Samba 4.1 and newer
Classification: Unclassified
Component: libsmbclient
4.10.6
All Linux
: P5 regression
: ---
Assigned To: Samba QA Contact
Samba QA Contact
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2019-05-27 06:41 UTC by samba
Modified: 2019-07-17 03:52 UTC (History)
1 user (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description samba 2019-05-27 06:41:06 UTC
Since updating to Samba 4.10.*, CUPS printers that require Samba authentication no longer work. Attempt to print results in the error `Session setup failed: NT_STATUS_ACCESS_DENIED`.

In addition, Samba modifies `/etc/cups/printer.conf` to add a new line: `AuthInfoRequired negotiate`. In my previous configuration, there was no line here previously, but others have reported Samba changing it from `AuthInfoRequired none` or from `AuthInfoRequired username,password`. [1]

If I revert samba, libwbclient, and smbclient to version 4.9.5, revert the line in /etc/cups/printer.conf, and restart CUPS, then I can print perfectly again.

I have performed a git bisect of samba, libwbclient, and smbclient collectively, with the following results:

r10 c6f1719b5e25984afc3168bdcd8efdb301108afd good
r11 84aad2ea7d53d8d7645bbd9e4c9ce6b09f6016c5 couldn't build
r12 755f624e2bbca22da44b9b9352aa095bc3603db3 bad

r11 will not build, and fails with:

========================================
+ install /build/samba-git/src/samba-pkg/usr/lib/samba/libdsdb-module-samba4.so (from bin/default/source4/dsdb/samdb/ldb_modules/libdsdb-module-samba4.inst.so)
Waf: Leaving directory `/build/samba-git/src/samba/bin/default'
Build failed
Traceback (most recent call last):
  File "/build/samba-git/src/samba/third_party/waf/waflib/Task.py", line 320, in process
    ret = self.run()
  File "/build/samba-git/src/samba/third_party/waf/waflib/Build.py", line 1101, in run
    fun(x.abspath(), y.abspath(), x.path_from(launch_node))
  File "/build/samba-git/src/samba/third_party/waf/waflib/Build.py", line 1168, in do_install
    raise Errors.WafError('Could not install the file %r' % tgt, e)
WafError: Could not install the file '/build/samba-git/src/samba-pkg/usr/lib/python2.7/site-packages/samba/dcerpc/idmap.so'

make: *** [Makefile:10: install] Error 1
==> ERROR: A failure occurred in build().
    Aborting...
==> ERROR: Build failed, check /var/lib/archbuild/extra-x86_64/username/build
========================================

I also tried the patch from bug 13939 [2], but this did not fix the problem. Several Arch users have reported this issue here [1].

(I apologise if I have selected the wrong fields for the bug.)

[1] https://bbs.archlinux.org/viewtopic.php?id=245658
[2] https://bugzilla.samba.org/show_bug.cgi?id=13939
Comment 1 samba 2019-07-17 03:52:15 UTC
I've also tested samba 4.10.6, because this commit [a] might have fixed this problem. Unfortunately it's still broken, but in a different way.

I upgraded samba, libwbclient, and smbclient, then restarted cups. I try to print, and the printer is put on hold. At this point, `/etc/cups/printers.conf` is unmodified. I try and resume the printer, but it goes back on hold. `/etc/cups/printers.conf` is now modified again, with `AuthInfoRequired none` added. There is nothing obvious in the logs.

I tried changing this line to `AuthInfoRequired username,password`, substituting my username and password, then restarting cups. After attempting to resume the printer, it is again put on hold. Now I can see in `/var/log/cups/error_log` the following line:

    Bad AuthInfoRequired on line 53 of printers.conf.

I try to resume, and `/etc/cups/printers.conf` is reverted to `AuthInfoRequired none`. I've tried to enter my password multiple times, so it's not in error. It's also the same password as in the `DeviceURI smb:///` line (which is used in the working samba 4.9.5), so I know it's correctly typed.

[a] https://bbs.archlinux.org/viewtopic.php?pid=1853162#p1853162