"AuthInfoRequired negotiate" in CUPS 2.2.7 does not work

[tillkamppeter]

I got the following bug report on Ubuntu:

We have our printers configured to print to a Windows print server. In Ubuntu 14.04 and 16.04 our setup works fine but in 18.04 our setup seems to be acting more like AuthInfoRequired username,password i.e. it prompts for a password when printing rather than using the available Kerberos credentials.

We are using an unaltered cupsd.conf file and are adding printers with the following command:

lpadmin -p "printer" -D "Printer" -L "room" -v "smb://printers.cis.strath.ac.uk/printers" -o Media=A4 -o PageSize=A4 -o printer-error-policy=abort-job -o auth-info-required=negotiate -m "CIS/hp-officejet_pro_476_576_series-ps.ppd"

the smb backend has been linked to /usr/lib/x86_64-linux-gnu/samba/smbspool_krb5_wrapper (I've added this the apparmor profile as it's blocked by default) and the permissions on this file changed to 700 (owner root) as per manpage instructions.

When using lp -d printer /tmp/test.txt I get the following response:

Password for myuid on localhost?

Typing my password gets the job accepted to the queue but it does spool to the Windows Print Server and in the error_log file I can see

D [24/Jul/2018:10:33:00 +0100] [Job 45] SMBSPOOL_KRB5 - AUTH_INFO_REQUIRED=negotiate
D [24/Jul/2018:10:33:00 +0100] [Job 45] SMBSPOOL_KRB5 - Started with uid=0
D [24/Jul/2018:10:33:00 +0100] [Job 45] SMBSPOOL_KRB5 - AUTH_UID is not set

As I said earlier this all works perfectly on Xenial and Trusty.
(A similar AuthInfoRequired negotiate setup also works in cups 2.2.5 on MacOS 10.13)

Any ideas how to fix this?

Thanks,

Ian.

The mentioned Ubuntu version Bionic (18.04) uses CUPS 2.2.7 and the problem occurs. Ubuntu Xenial (16.04) and Trusty (14.04) use older versions of CUPS and there the problem does not occur.
It seems that on CUPS 2.2.7 (and perhaps also newer versions) Kerberos authentication ceased to work.

[michaelrsweet]

The 2.2.x change log shows some fixes for Kerberos in 2.2.10 (Issue #5435).