RE: [Printing-architecture] Congrats, Mike! IPP Everywhere is now really Everywhere!

Hi All,

> Unfortunately, Microsoft did not adopt CUPS, but as you with CUPS 3.x 
> Microsoft is going all-IPP now and does away with classic printer 
> drivers, by their new Windows Protected Print architecture:
>
> https://techcommunity.microsoft.com/t5/security-compliance-and-identity/a-new-modern-and-secure-print-experience-from-windows/ba-p/4002645
>
>
> So all printer communication is via driverless IPP printing, in 
> Windows they are actually following Mopria but IPP Everywhere is very 
> similar, so we have IPP Everywhere everywhere now ...

It's all great news, but envisage complications in enterprise  environments.

With Windows Protected Print Mode (WPP), the above Tech Community page seems to indicate Microsoft is using RPC between the Windows client and Windows Print Server, not IPP (although it is most likely IPP encapsulated in RPC). The Microsoft IPP class driver is basically an inbox V4 (aka type 4) driver, albeit a bit special compared to other V4 drivers. As Samba's V4 driver support is a not-active work in progress, I suspect at this stage it won't be possible to connect a CUPS client to a WPP Windows Server and have Samba handle the RPC. Similarly won't be possible to use Samba (in combination with CUPS) to provide and alternative WPP server.

In an enterprise environment you generally need authenticated printing for Windows clients, unfortunately the inbox Microsoft IPP class driver with IPP connections doesn't support IPP authentication, as it never requests the IPP 'uri-authentication-supported' attribute, nor does it respond accordingly to the HTTP 401 unauthorized response. If you want to use the Microsoft IPP class driver for driverless printing and need authentication for Windows clients, I believe the only options are one of the following:
- Windows Protected Print Mode (WPP).
- Microsoft Universal Print (Azure cloud based).
- CUPS and 3rd party solution that provides authentication through a Print Support App (PSA) or similar. e.g. PaperCut?

In my case, I wanted to use the Microsoft IPP class driver with BYOD Windows laptops on a VPN. I ended up doing a custom solution with a modified CUPS to authorize users based on their VPN login. 



Cheers,
Doug