Re: printing via smbspool_krb5_wrapper cups backend always asks for user authentication

On Sun, 23 Aug 2026 11:31:51 +0000
Philipp Snizek via samba <[email protected]> wrote:

> Hi
> 
> I run Ubuntu 26 LTS with smbclient package version 4.23.6. I'm trying
> to get printing to work with cups and Kerberos. The Linux computer is
> a domain member, Kerberos auth works just fine, the user's keytab is
> stored in /tmp/krb5cc_UID_<random> according to how SSSD does these
> things. When I set up cups to use Kerberos (negotiate) and try to
> print via Windows print server, printing still expects user
> authentication. My finding is, that smbspool_krb5_wrapper seems to
> want the keytab's filename in a predictable way, asking for a
> filename /tmp/krb5cc_UID omitting <random>, as set by SSSD. For some
> reason it seems to ignore the user's environment variable KRB5CCNAME
> which points to /tmp/krb5cc_UID_<random>. When I cp -p
> /tmp/krb5cc_UID_<random> to /tmp/krb5cc_UID printing works.
> 
> I know, I can configure in SSSD in section [domain/MYDOMAN] the
> parameter krb5_ccname_template = FILE:%d/krb5cc_%U. Well, this gets
> ignored as well. SSSD will always use /tmp/krb5cc_UID_<random> as
> krb5ccname template, no matter which value is assigned to
> krb5_ccname_template. But this is a separate issue and has nothing to
> do with Samba. I'm mentioning this for completeness sake. What do I
> have to do to make cups/smbspool_krb5_wrapper use the authenticated
> user's KRB5CCNAME environment variable?
> 
> Thanks.
> 
> Best regards,
> Philipp

Not sure that you are asking the correct mailing list here, neither
cups or sssd have anything to do with Samba.

Have you tried removing sssd and using winbind instead ?

Rowland

-- 
To unsubscribe from this list go to the following URL and read the
instructions:  https://lists.samba.org/mailman/options/samba