<HTML> <!-- SECTION: Getting Started --> <HEAD> <TITLE>Using Kerberos Authentication</TITLE> <LINK REL="STYLESHEET" TYPE="text/css" HREF="../cups-printable.css"> </HEAD> <BODY> <H1 CLASS="title">Using Kerberos Authentication</H1> <P>CUPS allows you to use a Key Distribution Center (KDC) for authentication on your local CUPS server and when printing to a remote authenticated queue. This document describes how to configure CUPS to use Kerberos authentication and provides links to the MIT help pages for configuring Kerberos on your systems and network.</P> <H2 CLASS="title"><A NAME="REQUIREMENTS">System Requirements</A></H2> <p>The following are required to use Kerberos with CUPS:</p> <ol> <li>Heimdal Kerberos (any version) or MIT Kerberos (1.6.3 or newer)</li> <li>Properly configured Domain Name System (DNS) infrastructure (for your servers):<ol type='a'> <li>DNS server(s) with static IP addresses for all CUPS servers or configured to allow DHCP updates to the host addresses and</li> <li>All CUPS clients and servers configured to use the same DNS server(s).</li> </ol></li> <li>Properly configured Kerberos infrastructure:<ol type='a'> <li>KDC configured to allow CUPS servers to obtain Service Granting Tickets (SGTs) for the "host" and "HTTP" services/principals,</li> <li>LDAP-based user accounts - both OpenDirectory and ActiveDirectory provide this with the KDC, and</li> <li>CUPS clients and servers bound to the same KDC and LDAP server(s).</li> </ol></li> </ol> <H2 CLASS="title"><A NAME="KRB5">Configuring Kerberos on Your System</A></H2> <P>Before you can use Kerberos with CUPS, you will need to configure Kerberos on your system and setup a system as a KDC. Because this configuration is highly system and site-specific, please consult the following on-line resources provided by the creators of Kerberos at the Massachusetts Institute of Technology (MIT):</P> <UL> <LI><A HREF="http://web.mit.edu/kerberos/">Kerberos: The Network Authentication Protocol</A></LI> <LI><A HREF="http://web.mit.edu/macdev/KfM/Common/Documentation/faq-osx.html">Kerberos on macOS Frequently Asked Questions</A></LI> </UL> <P>The Linux Documentation Project also has a HOWTO on Kerberos:</P> <UL> <LI><A HREF="http://tldp.org/HOWTO/html_single/Kerberos-Infrastructure-HOWTO/">Kerberos Infrastructure HOWTO</A></LI> </UL> <H2 CLASS="title"><A NAME="CUPS">Configuring CUPS to Use Kerberos</A></H2> <P>Once you have configured Kerberos on your system(s), you can then enable Kerberos authentication by selecting the <tt>Negotiate</tt> authentication type. The simplest way to do this is using the <tt>cupsctl(8)</tt> command on your server(s):</P> <PRE CLASS="command"> <KBD>cupsctl DefaultAuthType=Negotiate</KBD> </PRE> <P>You can also enable Kerberos from the web interface by checking the <VAR>Use Kerberos Authentication</VAR> box and clicking <VAR>Change Settings</VAR>:</P> <PRE CLASS="command"> http://server.example.com:631/admin </PRE> <P>After you have enabled Kerberos authentication, use the built-in "authenticated" policy or your own custom policies with the printers you will be sharing. See <a href="policies.html">Managing Operation Policies</a> for more information.</P> <H2 CLASS="title"><A NAME="IMPLEMENT">Implementation Information</A></H2> <P>CUPS implements Kerberos over HTTP using GSSAPI and the service/principal names "host/server.example.com" for command-line access and "HTTP/server.example.com" for web-based access, where "server.example.com" is replaced by your CUPS server's hostname. Because of limitations in the HTTP GSSAPI protocol extension, only a single domain/KDC is supported for authentication. The HTTP extension is described in <a href="http://tools.ietf.org/html/rfc4559">RFC 4559</a>.</P> <P>When doing printing tasks that require authentication, CUPS requests single-use "tickets" from your login session to authenticate who you are. These tickets give CUPS a username of the form "user@REALM", which is then truncated to just "user" for purposes of user and group checks.</P> <P>In order to support printing to a shared printer, CUPS runs the IPP or SMB backend as the owner of the print job so it can obtain the necessary credentials when the job is de-spooled to the server.</P> </BODY> </HTML>
| Name | Type | Size | Permission | Actions |
|---|---|---|---|---|
| accounting.html | File | 2.63 KB | 0644 |
|
| admin.html | File | 11.66 KB | 0644 |
|
| api-admin.html | File | 19.99 KB | 0644 |
|
| api-filter.html | File | 61.66 KB | 0644 |
|
| api-ppd.html | File | 92.21 KB | 0644 |
|
| api-raster.html | File | 59.02 KB | 0644 |
|
| cgi.html | File | 2.58 KB | 0644 |
|
| cupspm.html | File | 370.35 KB | 0644 |
|
| encryption.html | File | 4.21 KB | 0644 |
|
| firewalls.html | File | 3.94 KB | 0644 |
|
| glossary.html | File | 2.66 KB | 0644 |
|
| kerberos.html | File | 4.21 KB | 0644 |
|
| license.html | File | 11.78 KB | 0644 |
|
| man-backend.html | File | 9.35 KB | 0644 |
|
| man-cancel.html | File | 2.56 KB | 0644 |
|
| man-classes.conf.html | File | 1.15 KB | 0644 |
|
| man-client.conf.html | File | 6.91 KB | 0644 |
|
| man-cups-config.html | File | 3.3 KB | 0644 |
|
| man-cups-files.conf.html | File | 12.26 KB | 0644 |
|
| man-cups-lpd.html | File | 4.75 KB | 0644 |
|
| man-cups-snmp.html | File | 2.72 KB | 0644 |
|
| man-cups.html | File | 7.43 KB | 0644 |
|
| man-cupsaccept.html | File | 2.48 KB | 0644 |
|
| man-cupsd-helper.html | File | 2.59 KB | 0644 |
|
| man-cupsd-logs.html | File | 9.55 KB | 0644 |
|
| man-cupsd.conf.html | File | 37.78 KB | 0644 |
|
| man-cupsd.html | File | 3.22 KB | 0644 |
|
| man-cupsenable.html | File | 2.97 KB | 0644 |
|
| man-cupstestppd.html | File | 4.83 KB | 0644 |
|
| man-filter.html | File | 11.36 KB | 0644 |
|
| man-ippevepcl.html | File | 1.88 KB | 0644 |
|
| man-ippeveprinter.html | File | 9.88 KB | 0644 |
|
| man-ippfind.html | File | 9.72 KB | 0644 |
|
| man-ipptool.html | File | 7.53 KB | 0644 |
|
| man-ipptoolfile.html | File | 27.3 KB | 0644 |
|
| man-lp.html | File | 7.32 KB | 0644 |
|
| man-lpadmin.html | File | 10.04 KB | 0644 |
|
| man-lpc.html | File | 2.11 KB | 0644 |
|
| man-lpinfo.html | File | 3.66 KB | 0644 |
|
| man-lpmove.html | File | 1.91 KB | 0644 |
|
| man-lpoptions.html | File | 3.88 KB | 0644 |
|
| man-lpq.html | File | 1.97 KB | 0644 |
|
| man-lpr.html | File | 5.93 KB | 0644 |
|
| man-lprm.html | File | 2.08 KB | 0644 |
|
| man-lpstat.html | File | 4.55 KB | 0644 |
|
| man-mime.convs.html | File | 2.59 KB | 0644 |
|
| man-mime.types.html | File | 5.47 KB | 0644 |
|
| man-notifier.html | File | 1.35 KB | 0644 |
|
| man-ppdc.html | File | 3.5 KB | 0644 |
|
| man-ppdhtml.html | File | 1.83 KB | 0644 |
|
| man-ppdi.html | File | 1.99 KB | 0644 |
|
| man-ppdmerge.html | File | 1.75 KB | 0644 |
|
| man-ppdpo.html | File | 2.09 KB | 0644 |
|
| man-printers.conf.html | File | 1.18 KB | 0644 |
|
| man-subscriptions.conf.html | File | 1.22 KB | 0644 |
|
| network.html | File | 18.56 KB | 0644 |
|
| options.html | File | 16.42 KB | 0644 |
|
| overview.html | File | 3.4 KB | 0644 |
|
| policies.html | File | 21.25 KB | 0644 |
|
| postscript-driver.html | File | 23.26 KB | 0644 |
|
| ppd-compiler.html | File | 45.13 KB | 0644 |
|
| raster-driver.html | File | 20.32 KB | 0644 |
|
| ref-ppdcfile.html | File | 69.29 KB | 0644 |
|
| security.html | File | 4.44 KB | 0644 |
|
| sharing.html | File | 4.45 KB | 0644 |
|
| spec-banner.html | File | 4.05 KB | 0644 |
|
| spec-command.html | File | 6.08 KB | 0644 |
|
| spec-design.html | File | 13.05 KB | 0644 |
|
| spec-ipp.html | File | 65.4 KB | 0644 |
|
| spec-ppd.html | File | 90.33 KB | 0644 |
|
| spec-raster.html | File | 23.34 KB | 0644 |
|
| spec-stp.html | File | 3.79 KB | 0644 |
|
| translation.html | File | 24.29 KB | 0644 |
|