domain users with full username (username@DOMAIN) over 33 characters cannot add or delete printers in web interface

[szelga]

To Reproduce
Steps to reproduce the behavior:

1. Have a machine joined into AD domain via sssd, have use_fully_qualified_names = True in /etc/sssd/sssd.conf. (This is not limited to Active Directory, should be applicable to any full username over 33 characters, e.g. if you manage to create a local user with such a long username, you could test it that way.)
2. Install cups server.
3. In cups-files.conf set:

   StripUserDomain No
   SystemGroup root lpadmin
   ErrorLog /var/log/cups/error_log
   

4. In cupsd.conf set:

   LogLevel debug2
   DefaultAuthType Negotiate # or Basic
   WebInterface Yes
   

   Also, in all <Location> tags set Allow all or Allow @LOCAL.
5. Create a domain user with full username length over 33 characters, say, really.really.long.username@company.name. Add that user into the local lpadmin group.
6. Login to the CUPS web interface under that user.
7. Try to add a printer via web interface.

Expected behavior
You would be able to add a printer.

Reality
You can access the /admin interface, choose a printer to add, but get "access denied" on the last stage.

Screenshots

System Information:

• tested on Astra Linux 1.8.4
• CUPS version 2.4.14

Additional context

error_log.txt

In the /var/log/cups/error_log I saw the following lines:

d [03/Dec/2025:13:18:11 +0500] [Client 68] con->uri="/admin/", con->best=0x5861b7630a10(/admin)
d [03/Dec/2025:13:18:11 +0500] cupsdFindCert(certificate=0C1B358FEB21C04D42AB52435E736E7F)
d [03/Dec/2025:13:18:11 +0500] cupsdFindCert: Returning "really.really.long.username@COMPA".
D [03/Dec/2025:13:18:11 +0500] [Client 68] Authorized as really.really.long.username@COMPA using Local.

Relevant code:

cups/scheduler/cert.c

Line 353 in f3ce6d3

cupsd_cert_t * /* O - Matching certificate or NULL */

cups/scheduler/cert.h

Line 15 in f3ce6d3

typedef struct cupsd_cert_s

Username length seems to have a hardcoded limit of 33 characters there. Is that limit necessary?

[michaelrsweet]

Will do some digging - there has to be a limit but I thought it was 255 characters.

[michaelrsweet]

[master 14bc0e7] Update cert username field to match connection username field size (Issue #1441)

[2.4.x 134ae24] Update cert username field to match connection username field size (Issue #1441)

[szelga]

only just now got around to test this issue. works just fine, thanks, @michaelrsweet !