Chapter 9. Using Samba to print to a Windows print server with Kerberos authentication
Chapter 9. Using Samba to print to a Windows print server with Kerberos authentication With the samba-krb5-printing wrapper, Active Directory (AD) users who are logged in to Red Hat Enterprise Linux (RHEL) can authenticate to Active Directory (AD) by using Kerberos and then print to a local CUPS print server that forwards the print job to a Windows print server. The benefit of this configuration is that the administrator of CUPS on RHEL does not need to store a fixed user name and password in the configuration. CUPS authenticates to AD with the Kerberos ticket of the user that sends the print job. Note Red Hat supports only submitting print jobs to CUPS from your local system, and not to re-share a printer on a Samba print server. Prerequisites The printer that you want to add to the local CUPS instance is shared on an AD print server. You joined the RHEL host as a member to the AD. CUPS is installed on RHEL, and the cups service is running. The PostScript Printer Description (PPD) file for the printer is stored in the /usr/share/cups/model/ directory. Procedure Install the samba-krb5-printing , samba-client , and krb5-workstation packages: Optional: Authenticate as a domain administrator and display the list of printers that are shared on the Windows print server: Optional: Display the list of CUPS models to identify the PPD name of your printer: You require the name of the PPD file when you add the printer in the step. Add the printer to CUPS: The command uses the following options: -p printer_name sets the name of the printer in CUPS. -v URI_to_Windows_printer sets the URI to the Windows printer. Use the following format: smb:// host_name / printer_share_name . -m PPD_file sets the PPD file the printer uses. -o auth-info-required=negotiate configures CUPS to use Kerberos authentication when it forwards print jobs to the remote server. -E enables the printer and CUPS accepts jobs for the printer. Verification Log into the RHEL host as an AD domain user. Authenticate as an AD domain user: Print a file to the printer you added to the local CUPS print server:
dnf install samba-krb5-printing samba-client krb5-workstation smbclient -L win_print_srv.ad.example.com -U administrator @ AD_KERBEROS_REALM --use-kerberos=required Sharename Type Comment --------- ---- ------- Example Printer Example lpinfo -m samsung.ppd Samsung M267x 287x Series PXL lpadmin -p " example_printer " -v smb:// win_print_srv.ad.example.com / Example -m samsung.ppd -o auth-info-required=negotiate -E kinit domain_user_name @ AD_KERBEROS_REALM lp -d example_printer file