Credentials from gnome-keyring is not used while printing

Hi Samuel,

AuthInfoRequired tells CUPS that the __remote__ printer needs authentication. When setting AuthInfoRequired, CUPS cannot check the username and password. It simply includes them in the print options when sending a job to the printer. From a quick glance at the gtk sources, it does not seem to pull those credentials from gnome-keyring, which is why it prompts your users every time for their password.

However, from your report it seems like you want authentication to the local CUPS instance, is this correct? Have you set up any other authentication with CUPS except AuthInfoRequired?

Lars, bug 753997 can be a similar problem.

Hi Lars,

The only authentication necessary to print is to the printer which is a SMB printer. There are no local CUPS authentication.

I'll try what was mentioned in bug 753997 ASAP this morning :
- Printing from OOo ...
- Hit "OK" without typing in a password (which I didn't think of before)

I just tried :

With username & password set in the gnome keyring :
- with AuthInfoRequired none
  - printing from OOo : no credential are asked, printing occurs
  - printing from gedit : no credential are asked, printing occurs
- with AuthInfoRequired username,password
  - printing from OOo : no credential are asked, printing occurs
  - printing from gedit : credentials are asked (attached capture <gedit_up_key.png>), printing occurs even if I hit "OK" without typing a password

Without username & password set in the gnome keyring (just deleted) :
- with AuthInfoRequired none
  - printing from OOo : credentials are asked once (attached capture <ooo_x_nokey.png>), printing occurs
  - printing from gedit : credentials are asked once (attached capture <gedit_none_nokey.png>), printing occurs
- with AuthInfoRequired username,password
  - printing from OOo : credentials are asked once (attached capture <ooo_x_nokey.png>), printing occurs
  - printing from gedit : credentials are asked twice (attached capture <gedit_up_nokey1.png> & <gedit_up_nokey1.png>), printing occurs even if I hit "OK" without typing a password to the 1st.

Hope this is helpfull,
Regards,
Samuel Bancal

Thanks a lot Samuel, your screen shots have helped me get to the bottom of the issue.

Credentials from the keyring are not inserted by the gtk dialog, but by another process (system-config-printer-applet) after the print dialog has sent the job to the server. CUPS sets AuthInfoRequired when authentication fails for some reason (maybe the printer was unreachable or the password changed). From this point on, the print dialog thinks it needs to ask for credentials, because it doesn't know that system-config-printer will insert them later. Hence, simply clicking OK without entering the password works.

The fix will be to have the gtk dialog read credentials from the keyring. I'm assigning myself to do this, but it's too late in the cycle to get this into 12.04.

I'm afraid the only workarounds -- short of patching CUPS or gtk -- are removing the AuthInfoRequired line manually every time it is changed or simply confirming the password prompt with empty user name and password.

Thank you for taking the time to report this bug and helping to make Ubuntu better. The issue you are reporting is an upstream one and it would be nice if somebody having it could send the bug to the developers of the software by following the instructions at https://wiki.ubuntu.com/Bugs/Upstream/GNOME. If you have done so, please tell us the number of the upstream bug (or the link), so we can add a bugwatch that will inform us about its status. Thanks in advance.

Ok.

I just submitted the bug here : https://bugzilla.gnome.org/show_bug.cgi?id=674264

To be more precise, I said :

> This worked perfectly last year and still works today ...
> up to the moment when the /etc/cups/printers.conf is auto-modified with the following change :
> AuthInfoRequired none
> to
> AuthInfoRequired username,password

I was suspecting a patch or something on client's side to have changed so that it doesn't work any more.
Today, I could reload the image of the installation made in 2010 (not dist-upgraded). I'm absolutely sure that was working. The problem occurs also on that system.

My conclusion is that something changed on the printing server (or SMB auth server) which makes that new buggy behaviour on the client.

This bug has become much worse with Ubuntu 12.04 - to the point where it is not practical to use Ubuntu 12.04 in an enterprise with Samba networked printers.

If you create a networked (Samba) printer, and select "Prompt User If Authentication Is Required" the following happens:

- LibreOffice does not prompt for authentication when printing to Samba printers. The only option is to go into the print queue, right click the job, and select "Authenticate".

- Checking the "Save Password" box does nothing, if the user prints again the job is held for authentication.

- Apps that use the built-in print dialogs will prompt for authentication, and do not display a "Save Password" option.

- 100% of jobs are held for authentication unless the user's credentials are stored in /etc/cups/printers.conf which is not possible if multiple users are using the same computer. Each user should be able to have their own credentials.

This is very frustrating since this bug has persisted since the last LTS and nothing has been done about it. Is there *anything* I can do as a non-programmer to help this get fixed?

It's been two months since 12.04's release and the most recent user update to this report indicating that the problem has gotten worse. Any chance of getting a maintainer's update or patch for this. This seems like a rather critical flaw.

Any one looking at this?

Seems not, unassigning Lars since I don't think he's working on the issue and have somebody assigned might block others to look at the bug

Note that the issue is an upstream one, so https://bugzilla.gnome.org/show_bug.cgi?id=674264 is the right place to discuss it

@Nate: comment 15 seems to be another issue and about gtk2, another bug should be opened if there is not already one (seems similar to https://bugzilla.gnome.org/show_bug.cgi?id=664640)

we have same problem of #15.

system-config-printer-applet check if any job need to be authenticated and prompt for password, but its not running by default on 12.04.

maybe it was replaced by indicator-printers-service, but this indicator doesn't auth jobs automaticaly.

if i run system-config-printer-applet manualy, everything works.

@Ritesh: is it working for upstream GNOME? Do they still run the applet? We are using s-c-p under Unity, just not the applet.

The proper fix there is to make GTK's print dialog handle the auth requests, until that happens running s-c-p-a seems a valid workaround

hi @seb128

  This does not work with upstream, as s-c-p is not a part of gnome-os nor is the password saved by gtk. We do have a valid workaround for both precise/trusty. I am looking at trying to "fix" s-c-p to work with trusty.

So.. any chances of this being fixed in Trusty?

> So.. any chances of this being fixed in Trusty?

That doesn't seem likely, the proper fix would be to add support for those credential to GTK but it seems nobody in the GTK team is working on that. You can always run system-config-printer-applet as a workaround if needed though...

There is definite improvement in Trusty, since saving the credentials to the keyring now works. However, they are only used if the user opens the s-c-p queue window for the specific printer... Also, running s-c-p-applet seems to release only one job from the queue and then stops working.

Status changed to 'Confirmed' because the bug affects multiple users.