Credentials from gnome-keyring is not used while printing

Bug #959451 reported by Samuel Bancal on 2012-03-19
68
This bug affects 13 people
Affects Status Importance Assigned to Milestone
GTK+
New
Medium
gtk+2.0 (Ubuntu)
Undecided
Unassigned
gtk+3.0 (Ubuntu)
Low
Unassigned

Bug Description

Hi,

For end-user desktops, we've inserted the printing credentials in the user's gnome-keyring to make printing authentication automated.

This worked perfectly last year and still works today ... up to the moment when the /etc/cups/printers.conf is auto-modified with the following change :
AuthInfoRequired none
to
AuthInfoRequired username,password

The result is that the user gets a Window which asks the username and the password to print.

The printers are installed system wide (authentication can not be done with the printer's URI) and we send printing jobs to a Windows printing server.

Thanks,

== Workaround ==
* add system-config-printer-applet to session start-up.
* alternate, add the username/password to DeviceURI in printer.conf

== Note ==
* print indicator service is deprecated, and usually pops us s-c-p for queue mgmt.

Samuel Bancal (samuel-bancal) wrote :
Lars Karlitski (larsu) wrote :

Hi Samuel,

AuthInfoRequired tells CUPS that the __remote__ printer needs authentication. When setting AuthInfoRequired, CUPS cannot check the username and password. It simply includes them in the print options when sending a job to the printer. From a quick glance at the gtk sources, it does not seem to pull those credentials from gnome-keyring, which is why it prompts your users every time for their password.

However, from your report it seems like you want authentication to the local CUPS instance, is this correct? Have you set up any other authentication with CUPS except AuthInfoRequired?

Changed in cups (Ubuntu):
status: New → Incomplete
Till Kamppeter (till-kamppeter) wrote :

Lars, bug 753997 can be a similar problem.

Samuel Bancal (samuel-bancal) wrote :

Hi Lars,

The only authentication necessary to print is to the printer which is a SMB printer. There are no local CUPS authentication.

I'll try what was mentioned in bug 753997 ASAP this morning :
- Printing from OOo ...
- Hit "OK" without typing in a password (which I didn't think of before)

Samuel Bancal (samuel-bancal) wrote :

I just tried :

With username & password set in the gnome keyring :
- with AuthInfoRequired none
  - printing from OOo : no credential are asked, printing occurs
  - printing from gedit : no credential are asked, printing occurs
- with AuthInfoRequired username,password
  - printing from OOo : no credential are asked, printing occurs
  - printing from gedit : credentials are asked (attached capture <gedit_up_key.png>), printing occurs even if I hit "OK" without typing a password

Without username & password set in the gnome keyring (just deleted) :
- with AuthInfoRequired none
  - printing from OOo : credentials are asked once (attached capture <ooo_x_nokey.png>), printing occurs
  - printing from gedit : credentials are asked once (attached capture <gedit_none_nokey.png>), printing occurs
- with AuthInfoRequired username,password
  - printing from OOo : credentials are asked once (attached capture <ooo_x_nokey.png>), printing occurs
  - printing from gedit : credentials are asked twice (attached capture <gedit_up_nokey1.png> & <gedit_up_nokey1.png>), printing occurs even if I hit "OK" without typing a password to the 1st.

Hope this is helpfull,
Regards,
Samuel Bancal

Samuel Bancal (samuel-bancal) wrote :
Samuel Bancal (samuel-bancal) wrote :
Samuel Bancal (samuel-bancal) wrote :
Samuel Bancal (samuel-bancal) wrote :
Samuel Bancal (samuel-bancal) wrote :
Lars Karlitski (larsu) wrote :

Thanks a lot Samuel, your screen shots have helped me get to the bottom of the issue.

Credentials from the keyring are not inserted by the gtk dialog, but by another process (system-config-printer-applet) after the print dialog has sent the job to the server. CUPS sets AuthInfoRequired when authentication fails for some reason (maybe the printer was unreachable or the password changed). From this point on, the print dialog thinks it needs to ask for credentials, because it doesn't know that system-config-printer will insert them later. Hence, simply clicking OK without entering the password works.

The fix will be to have the gtk dialog read credentials from the keyring. I'm assigning myself to do this, but it's too late in the cycle to get this into 12.04.

I'm afraid the only workarounds -- short of patching CUPS or gtk -- are removing the AuthInfoRequired line manually every time it is changed or simply confirming the password prompt with empty user name and password.

Changed in cups (Ubuntu):
assignee: nobody → Lars Uebernickel (larsu)
status: Incomplete → Confirmed
Lars Karlitski (larsu) on 2012-03-30
affects: cups (Ubuntu) → gtk+3.0 (Ubuntu)
Sebastien Bacher (seb128) wrote :

Thank you for taking the time to report this bug and helping to make Ubuntu better. The issue you are reporting is an upstream one and it would be nice if somebody having it could send the bug to the developers of the software by following the instructions at https://wiki.ubuntu.com/Bugs/Upstream/GNOME. If you have done so, please tell us the number of the upstream bug (or the link), so we can add a bugwatch that will inform us about its status. Thanks in advance.

Changed in gtk+3.0 (Ubuntu):
importance: Undecided → Low
Samuel Bancal (samuel-bancal) wrote :

Ok.

I just submitted the bug here : https://bugzilla.gnome.org/show_bug.cgi?id=674264

Samuel Bancal (samuel-bancal) wrote :

To be more precise, I said :

> This worked perfectly last year and still works today ...
> up to the moment when the /etc/cups/printers.conf is auto-modified with the following change :
> AuthInfoRequired none
> to
> AuthInfoRequired username,password

I was suspecting a patch or something on client's side to have changed so that it doesn't work any more.
Today, I could reload the image of the installation made in 2010 (not dist-upgraded). I'm absolutely sure that was working. The problem occurs also on that system.

My conclusion is that something changed on the printing server (or SMB auth server) which makes that new buggy behaviour on the client.

Nate Gingras (suboscillator) wrote :

This bug has become much worse with Ubuntu 12.04 - to the point where it is not practical to use Ubuntu 12.04 in an enterprise with Samba networked printers.

If you create a networked (Samba) printer, and select "Prompt User If Authentication Is Required" the following happens:

- LibreOffice does not prompt for authentication when printing to Samba printers. The only option is to go into the print queue, right click the job, and select "Authenticate".

- Checking the "Save Password" box does nothing, if the user prints again the job is held for authentication.

- Apps that use the built-in print dialogs will prompt for authentication, and do not display a "Save Password" option.

- 100% of jobs are held for authentication unless the user's credentials are stored in /etc/cups/printers.conf which is not possible if multiple users are using the same computer. Each user should be able to have their own credentials.

This is very frustrating since this bug has persisted since the last LTS and nothing has been done about it. Is there *anything* I can do as a non-programmer to help this get fixed?

Jamin W. Collins (jcollins) wrote :

It's been two months since 12.04's release and the most recent user update to this report indicating that the problem has gotten worse. Any chance of getting a maintainer's update or patch for this. This seems like a rather critical flaw.

Konrad Hofer (konrad.hofer) wrote :

Any one looking at this?

Sebastien Bacher (seb128) wrote :

Seems not, unassigning Lars since I don't think he's working on the issue and have somebody assigned might block others to look at the bug

Note that the issue is an upstream one, so https://bugzilla.gnome.org/show_bug.cgi?id=674264 is the right place to discuss it

Changed in gtk+3.0 (Ubuntu):
status: Confirmed → Triaged
assignee: Lars Uebernickel (larsu) → nobody
Changed in gtk:
importance: Unknown → Medium
status: Unknown → New
Sebastien Bacher (seb128) wrote :

@Nate: comment 15 seems to be another issue and about gtk2, another bug should be opened if there is not already one (seems similar to https://bugzilla.gnome.org/show_bug.cgi?id=664640)

Anderson Luiz Alves (alacn1) wrote :

we have same problem of #15.

system-config-printer-applet check if any job need to be authenticated and prompt for password, but its not running by default on 12.04.

maybe it was replaced by indicator-printers-service, but this indicator doesn't auth jobs automaticaly.

if i run system-config-printer-applet manualy, everything works.

tags: added: trusty
removed: lucid
Changed in gtk+3.0 (Ubuntu):
assignee: nobody → Ritesh Khadgaray (khadgaray)
status: Triaged → In Progress
affects: gtk+3.0 (Ubuntu) → ubuntu
affects: ubuntu → gtk+3.0 (Ubuntu)
tags: added: rfe
description: updated
Sebastien Bacher (seb128) wrote :

@Ritesh: is it working for upstream GNOME? Do they still run the applet? We are using s-c-p under Unity, just not the applet.

The proper fix there is to make GTK's print dialog handle the auth requests, until that happens running s-c-p-a seems a valid workaround

Ritesh Khadgaray (khadgaray) wrote :

hi @seb128

  This does not work with upstream, as s-c-p is not a part of gnome-os nor is the password saved by gtk. We do have a valid workaround for both precise/trusty. I am looking at trying to "fix" s-c-p to work with trusty.

description: updated
Changed in gtk+3.0 (Ubuntu):
assignee: Ritesh Khadgaray (khadgaray) → nobody
Mikko Pesari (mpesari) wrote :

So.. any chances of this being fixed in Trusty?

Sebastien Bacher (seb128) wrote :

> So.. any chances of this being fixed in Trusty?

That doesn't seem likely, the proper fix would be to add support for those credential to GTK but it seems nobody in the GTK team is working on that. You can always run system-config-printer-applet as a workaround if needed though...

description: updated
description: updated
description: updated
Mikko Pesari (mpesari) wrote :

There is definite improvement in Trusty, since saving the credentials to the keyring now works. However, they are only used if the user opens the s-c-p queue window for the specific printer... Also, running s-c-p-applet seems to release only one job from the queue and then stops working.

Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

affects: debian → gtk+2.0 (Ubuntu)
Changed in gtk+2.0 (Ubuntu):
status: New → Confirmed
tags: removed: rfe
affects: gtk+2.0 (Ubuntu) → ubuntu
Changed in ubuntu:
status: New → Confirmed
Changed in ubuntu:
status: New → Confirmed
affects: ubuntu → gtk+2.0 (Ubuntu)
affects: gtk+3.0 (Ubuntu) → ubuntu
Changed in ubuntu:
status: In Progress → Confirmed
affects: ubuntu → gtk+3.0 (Ubuntu)
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.