enable gssapi support in cupsys 1.3

[Jerome Haltom]

Binary package hint: cupsys

Cups 1.3 adds support for Kerberos authentication using Negotiate. This can be enabled using --enable-gssapi. Dependencies on a Kerberos library have to be added as well.

This would be greatly useful out of the box for Windows networks (and well configured Unix networks too!)

[Till Kamppeter (till-kamppeter)]

According to "ldd /usr/sbin/cupsd" our CUPS seems to have gssapi/Kerberos support. Perhaps the AppArmor protection breaks it. Can you do

aa-complain cupsd

and then check again.

[Martin Pitt (pitti)]

Also, after you tested it, please attach /var/log/kern.log, so that I can see the apparmor messages.

[Till Kamppeter (till-kamppeter)]

Pitti, probably we should also add "--enable-gssapi" from the next build on to make really sure that CUPS gets built with gssapi support.

[Martin Pitt (pitti)]

Jerome, any news about that? Without the tests with disabling AppArmor and sending me the kernel logs I cannot do anything about it.

[Jerome Haltom (wasabi)]

Hmm. Not totally sure. I had never checked whether cupsd was linked to krb5, just whether the "Use Kerberos Authentication" option was available in the UI. At the time of filing the bug, it was not available.

I built my own cups packages, added a dependency to krb5, and added --enable-gssapi, and the option was available. I then filed the bug.

As of today, I reinstalled the gutsy version of the packages, and the option is still available. Am I crazy or did somebody just simply fix this?

[Jerome Haltom (wasabi)]

I confirm:

cupsys (1.3.0-2) unstable; urgency=low

  * debian/control: Re-add erroneously dropped adduser dependencies to cupsys
    and cupsys-client. Still needed for addgroup lpadmin. (closes: #437951)
  * debian/control: Add missing libkrb5-dev dependency to libcupsys2-dev.

 -- Martin Pitt <email address hidden> Wed, 15 Aug 2007 09:22:29 +0200

Martin, you fixed it, in Debian. Says it merged on the 15th of August as well. I filed my bug on the 21st. I am *fairly certain* that at the time my system was up to date. I guess I could be wrong. I'd think I'd be an idiot to compile my own version without checking whether it was in the archives. Did it perhaps not build for awhile due to an error?

[Jerome Haltom (wasabi)]

Okay, I take my last message back. I am an idiot AND blind. You only fixed a -dev dependency.

Regardless of my ability to read, it is now fixed in the archive, so this bug can be closed.

[Till Kamppeter (till-kamppeter)]

Pitti, can you add "--enable-gssapi" to the "./configure" command line from the next Debian/Ubuntu releases of CUPS on? Only to make sure that CUPS has really gssapi support activated.

[Martin Pitt (pitti)]

Jerome, thanks for checking this again and confirming.

Till, I committed this change to the svn trunk, so that it does not get lost.