Can not print on an SMB shared printer after password change

[Theodotos Andreou]

Binary package hint: cups

I print to a number of SMB shared printers in a 2003 Active Directory domain. My password is changed from time to time as a policy in our organisation. When this happens I get prompted to enter the new password but I can no longer connect to the using the new password. The previous password was saved using the "Saved forever" option

The only workaround I found is to delete the printer and recreate it. I had this problem several times in the past and so are the rest of my ubuntu users. Is there a workaround for that. Can someone confirm this bug?

I tried to sniff the packets from my PC to the Print Server but wireshark showed nothing! This means that the problem is actually on my side. I can connect to other domain services like file shares using the same credentials. I am using the DOMAIN\username format to connect.

The relevant cups error logs are here in case you want to have a look:
http://paste.ubuntu.com/580463/

ProblemType: Bug
DistroRelease: Ubuntu 10.10
Package: cups 1.4.4-6ubuntu2.3
ProcVersionSignature: Ubuntu 2.6.35-27.48-generic-pae 2.6.35.11
Uname: Linux 2.6.35-27-generic-pae i686
NonfreeKernelModules: fglrx
Architecture: i386
Date: Tue Mar 15 08:25:04 2011
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 10.10 "Maverick Meerkat" - Release i386 (20101007)
Lpstat:
 device for Deskjet-F4200-series: hp:/usb/Deskjet_F4200_series?serial=CN84A3D1SN052D
 device for FOLLOWME: smb://prs03ist00.lim.tepak.int/FollowMe
 device for hp-LaserJet-2300-series: dnssd://hp%20LaserJet%202300%20series%20(0001E6A8204B)._printer._tcp.local/
 device for PDF: cups-pdf:/
 device for SRB02MF001: smb://prs03ist00.lim.tepak.int/srb02mf001
MachineType: LENOVO 2767WB7
Papersize: letter
PccardctlIdent:
 Socket 0:
   no product info available
PccardctlStatus:
 Socket 0:
   no card
PpdFiles:
 SRB02MF001: NRG MP C2500 PXL
 Deskjet-F4200-series: HP Deskjet f4200 Series hpijs, 3.10.6
 PDF: Generic CUPS-PDF Printer
 hp-LaserJet-2300-series: HP LaserJet 2300 Postscript (recommended)
 FOLLOWME: KONICA MINOLTA C252 PS(P)
ProcCmdLine: BOOT_IMAGE=/boot/vmlinuz-2.6.35-27-generic-pae root=UUID=5440d147-6520-49af-a1fd-76b8ec027c80 ro splash quiet splash
ProcEnviron:
 PATH=(custom, user)
 LANG=el_GR.utf8
 SHELL=/bin/bash
SourcePackage: cups
dmi.bios.date: 10/17/2008
dmi.bios.vendor: LENOVO
dmi.bios.version: 7UET49WW (1.19 )
dmi.board.name: 2767WB7
dmi.board.vendor: LENOVO
dmi.board.version: Not Available
dmi.chassis.asset.tag: No Asset Information
dmi.chassis.type: 10
dmi.chassis.vendor: LENOVO
dmi.chassis.version: Not Available
dmi.modalias: dmi:bvnLENOVO:bvr7UET49WW(1.19):bd10/17/2008:svnLENOVO:pn2767WB7:pvrThinkPadT400:rvnLENOVO:rn2767WB7:rvrNotAvailable:cvnLENOVO:ct10:cvrNotAvailable:
dmi.product.name: 2767WB7
dmi.product.version: ThinkPad T400
dmi.sys.vendor: LENOVO

[Till Kamppeter (till-kamppeter)]

Can you attach the file /etc/cups/printers.conf? If you do not want to post a file containing your password, then edit the file at first. If you find your old password somewhere in your file, replace it by "OLDPASSWORD", if you find your new password, replace it by "NEWPASSWORD". Thanks.

[Till Kamppeter (till-kamppeter)]

Tim, Jiri, is there any password caching in the system-config-printer applet? Or is the password cached by CUPS? Where does it get cached?

[Theodotos Andreou (theodotos)]

Here it is:

http://paste.ubuntu.com/581090/

The real password is removed but the one displayed previously was the correct one. The SMB printers of interest are "FOLLOWME" and "SRB02MF001"

Thanks for looking into this!

[Theodotos Andreou (theodotos)]

Actually the SRB02MF001 was deleted and recreated and works fine. I kept the problematic FOLLOWME configuration so we get the chance to test it.

[Till Kamppeter (till-kamppeter)]

I have checked your printers.conf and the non-working FollowMe has the line

AuthInfoRequired username,password\

which the working SRB02MF001 does not have. Stop the CUPS daemon, then edit your /etc/cups/printers.conf removing the mentioned line from the entry of FollowMe. Then start CUPS again and see whether the problem goes away. Seems that older CUPS versions needed (or at least inserted) this line and newer ones have problems with it. If the removal helps, we will look into removing this line during the package installation/update of CUPS.

[Theodotos Andreou (theodotos)]

OK I now see what is happening. I commented out the "AuthInfoRequired" line but I still get the problem. The issue is that the follow me line still has the old password and it will not update it automatically after prompted even when I click the "Remember Password" option.

That explains why it works when deleted. All entries are erased and recreated when the new printer is created. But for whatever reason it cannot update the password to an existing printer.

I think this is a serious bug that could affect the use of Ubuntu in enterprise environments.

[Till Kamppeter (till-kamppeter)]

Tim, Jiri, can there be something wrong with the password prompting facility of the system-config-printer applet? Does it perhaps need some updated way to tell CUPS abot the password change? How does the entered password get into printers.conf?

[Tim Waugh (twaugh)]

So, here's what happened:

CUPS receives job to print, fires up smb backend to print it
smb backend communicates with server, server requires password
We don't have one, so smb backend stops, telling cupsd why
cupsd marks the job as requiring authentication
At this point, CUPS knows that "username,password" is required for jobs to this queue so it adds that attribute to the printer configuration.
s-c-printer-applet sees the job has stopped and requires auth, so displays an authentication dialog
Once received from user, the applet uses IPP-Authenticate-Job to restart the job

Now, for future jobs, CUPS will actually refuse to queue the job unless it is accompanies by "username,password"-type auth-info. It already knows, from past experience, that a username and password will be required.

So now it is up to the application that talks to CUPS to provide the username and password.

Conveniently, s-c-printer-applet stored the user's credentials (if they chose to) in the GNOME keyring, so you can look it up there. Alternatively, the application has to make its own arrangements e.g. presenting another auth dialog at that point.

[Till Kamppeter (till-kamppeter)]

Tim, would it not be much more user-frendly, if one does the following:

If a print job fails because it needs a password, the applet askes for user/password and gives the possibility to save the credentials. If the user opts for saving, it sends the job and if the credentials are correct it adds "<user>:<password>@" to the printer's URI, if not, it simply sends the job.

As many print dialogs of applications do not support asking for passwords, it should be assured that the applet also asks for any future jobs which fail due to a missing or wrong user/password in the URI. The applet should perhaps even remove the "username,password" from the printer configuration, so that CUPS gets the job and it can ask for credentials again for the case that the user did not save the credentials.

WDYT?

[Tim Waugh (twaugh)]

No -- this would permanently break the queue when the password is changed.

Print dialogs that want to talk to CUPS must support authentication.

[Till Kamppeter (till-kamppeter)]

Tim, so this means that all is working as designed? Should the bug be closed?

[Tim Waugh (twaugh)]

"When this happens I get prompted to enter the new password but I can no longer connect to the using the new password."

This is the crux of the problem from what I can see. Need to find out which prompt that is, and why it isn't correctly supplying the right credentials (or why they fail).

[Launchpad Janitor (janitor)]

[Expired for cups (Ubuntu) because there has been no activity for 60 days.]

[Ronan Mooney (roomey)]

This is the dialogue box which causes the error (see attachment "Print dialog bug.pdf" .

FYI workaround is:
* Open the printer configuration and right click on the already added printer and select "Properties":
* Go to the Device URI section and click “Change…”
On the top menu item (what your printer is called) select the radio button to “set authentication details now” and type in your username/password

[Ronan Mooney (roomey)]

[12:08] ######:~# xprop
_NET_WM_ICON_GEOMETRY(CARDINAL) = 617, 0, 83, 30
_NET_FRAME_EXTENTS(CARDINAL) = 3, 3, 29, 3
_NET_WM_ALLOWED_ACTIONS(ATOM) = _NET_WM_ACTION_CLOSE, _NET_WM_ACTION_ABOVE, _NET_WM_ACTION_BELOW, _NET_WM_ACTION_FULLSCREEN, _NET_WM_ACTION_MOVE, _NET_WM_ACTION_SHADE, _NET_WM_ACTION_CHANGE_DESKTOP, _NET_WM_ACTION_STICK
WM_STATE(WM_STATE):
                window state: Normal
                icon window: 0xca3dd00
_NET_WM_DESKTOP(CARDINAL) = 0
_NET_WM_STATE(ATOM) = _NET_WM_STATE_MODAL, _NET_WM_STATE_ABOVE
WM_HINTS(WM_HINTS):
                Client accepts input or input focus: True
                Initial state is Normal State.
                window id # of group leader: 0x5200001
_GTK_THEME_VARIANT(UTF8_STRING) =
XdndAware(ATOM) = BITMAP
_NET_WM_OPAQUE_REGION(CARDINAL) = 7, 0, 571, 7, 0, 7, 585, 187
_NET_WM_WINDOW_TYPE(ATOM) = _NET_WM_WINDOW_TYPE_DIALOG
_NET_WM_SYNC_REQUEST_COUNTER(CARDINAL) = 85990809, 85990810
_NET_WM_USER_TIME_WINDOW(WINDOW): window id # 0x5201d98
WM_CLIENT_LEADER(WINDOW): window id # 0x5200001
_NET_WM_PID(CARDINAL) = 20562
WM_LOCALE_NAME(STRING) = "en_US.UTF-8"
WM_CLIENT_MACHINE(STRING) = "work"
WM_NORMAL_HINTS(WM_SIZE_HINTS):
                program specified location: 0, 0
                program specified minimum size: 585 by 194
                program specified maximum size: 585 by 194
                program specified base size: 0 by 0
                window gravity: NorthWest
WM_PROTOCOLS(ATOM): protocols WM_DELETE_WINDOW, WM_TAKE_FOCUS, _NET_WM_PING, _NET_WM_SYNC_REQUEST
WM_CLASS(STRING) = "system-config-printer", "Scp-dbus-service.py"
WM_ICON_NAME(STRING) = "Authentication"
_NET_WM_ICON_NAME(UTF8_STRING) = "Authentication"
WM_NAME(STRING) = "Authentication"
_NET_WM_NAME(UTF8_STRING) = "Authentication"

[teramind (soeren-w)]

@ronan Where can I find this printer configuration?