Chapter 9. Using Samba to print to a Windows print server with Kerberos authentication
With the samba-krb5-printing wrapper, Active Directory (AD) users who are logged in to Red Hat Enterprise Linux (RHEL) can authenticate to Active Directory (AD) by using Kerberos and then print to a local CUPS print server that forwards the print job to a Windows print server.
The benefit of this configuration is that the administrator of CUPS on RHEL does not need to store a fixed user name and password in the configuration. CUPS authenticates to AD with the Kerberos ticket of the user that sends the print job.
Red Hat supports only submitting print jobs to CUPS from your local system, and not to re-share a printer on a Samba print server.
Prerequisites
- The printer that you want to add to the local CUPS instance is shared on an AD print server.
- You joined the RHEL host as a member to the AD.
-
CUPS is installed on RHEL, and the
cupsservice is running. -
The PostScript Printer Description (PPD) file for the printer is stored in the
/usr/share/cups/model/directory.
Procedure
Install the
samba-krb5-printing,samba-client, andkrb5-workstationpackages:# dnf install samba-krb5-printing samba-client krb5-workstationOptional: Authenticate as a domain administrator and display the list of printers that are shared on the Windows print server:
# smbclient -L win_print_srv.ad.example.com -U administrator@AD_KERBEROS_REALM --use-kerberos=required Sharename Type Comment --------- ---- ------- ... Example Printer Example ...Optional: Display the list of CUPS models to identify the PPD name of your printer:
lpinfo -m ... samsung.ppd Samsung M267x 287x Series PXL ...
You require the name of the PPD file when you add the printer in the next step.
Add the printer to CUPS:
# lpadmin -p "example_printer" -v smb://win_print_srv.ad.example.com/Example -m samsung.ppd -o auth-info-required=negotiate -EThe command uses the following options:
-
-p printer_namesets the name of the printer in CUPS. -
-v URI_to_Windows_printersets the URI to the Windows printer. Use the following format:smb://host_name/printer_share_name. -
-m PPD_filesets the PPD file the printer uses. -
-o auth-info-required=negotiateconfigures CUPS to use Kerberos authentication when it forwards print jobs to the remote server. -
-Eenables the printer and CUPS accepts jobs for the printer.
-
Verification
- Log into the RHEL host as an AD domain user.
Authenticate as an AD domain user:
# kinit domain_user_name@AD_KERBEROS_REALMPrint a file to the printer you added to the local CUPS print server:
# lp -d example_printer file
