Gecko [ 122.154.134.11 ]

Name	Size	Permission
accounting.html	2.53 KB	-r--r--r--
api-array.html	32.95 KB	-r--r--r--
api-cgi.html	32.93 KB	-r--r--r--
api-cups.html	88.38 KB	-r--r--r--
api-driver.html	35.72 KB	-r--r--r--
api-filedir.html	32.22 KB	-r--r--r--
api-filter.html	46.11 KB	-r--r--r--
api-httpipp.html	160.97 KB	-r--r--r--
api-mime.html	21.68 KB	-r--r--r--
api-overview.html	11.27 KB	-r--r--r--
api-ppd.html	82.86 KB	-r--r--r--
api-ppdc.html	63.67 KB	-r--r--r--
api-raster.html	50.05 KB	-r--r--r--
cgi.html	2.46 KB	-r--r--r--
glossary.html	2.72 KB	-r--r--r--
kerberos.html	4.17 KB	-r--r--r--
license.html	48.75 KB	-r--r--r--
man-backend.html	5.71 KB	-r--r--r--
man-cancel.html	2.17 KB	-r--r--r--
man-cups-config.html	2.49 KB	-r--r--r--
man-cups-lpd.html	4.41 KB	-r--r--r--
man-cups-polld.html	1.37 KB	-r--r--r--
man-cupsaccept.html	2.51 KB	-r--r--r--
man-cupsaddsmb.html	6.65 KB	-r--r--r--
man-cupsd.html	2.58 KB	-r--r--r--
man-cupsenable.html	2.84 KB	-r--r--r--
man-cupstestdsc.html	1.72 KB	-r--r--r--
man-cupstestppd.html	3.93 KB	-r--r--r--
man-drv.html	1.31 KB	-r--r--r--
man-filter.html	7.47 KB	-r--r--r--
man-lp.html	6.96 KB	-r--r--r--
man-lpadmin.html	6.87 KB	-r--r--r--
man-lpc.html	2.4 KB	-r--r--r--
man-lpinfo.html	2.91 KB	-r--r--r--
man-lpmove.html	1.59 KB	-r--r--r--
man-lpoptions.html	3.61 KB	-r--r--r--
man-lppasswd.html	2.14 KB	-r--r--r--
man-lpq.html	1.96 KB	-r--r--r--
man-lpr.html	3.49 KB	-r--r--r--
man-lprm.html	1.9 KB	-r--r--r--
man-lpstat.html	3.86 KB	-r--r--r--
man-mime.convs.html	1.69 KB	-r--r--r--
man-mime.types.html	4.09 KB	-r--r--r--
man-notifier.html	4.29 KB	-r--r--r--
man-ppdc.html	2.59 KB	-r--r--r--
man-ppdhtml.html	1.27 KB	-r--r--r--
man-ppdi.html	1.34 KB	-r--r--r--
man-ppdmerge.html	1.32 KB	-r--r--r--
man-ppdpo.html	1.48 KB	-r--r--r--
network.html	26.99 KB	-r--r--r--
options.html	23.18 KB	-r--r--r--
overview.html	3.46 KB	-r--r--r--
policies.html	20.83 KB	-r--r--r--
postscript-driver.html	21.14 KB	-r--r--r--
ppd-compiler.html	42.79 KB	-r--r--r--
raster-driver.html	18.22 KB	-r--r--r--
ref-access_log.html	4.38 KB	-r--r--r--
ref-classes-conf.html	13.72 KB	-r--r--r--
ref-client-conf.html	2.08 KB	-r--r--r--
ref-cupsd-conf.html	83.53 KB	-r--r--r--
ref-error_log.html	1.6 KB	-r--r--r--
ref-mailto-conf.html	2.67 KB	-r--r--r--
ref-page_log.html	2.66 KB	-r--r--r--
ref-ppdcfile.html	69.38 KB	-r--r--r--
ref-printers-conf.html	17.88 KB	-r--r--r--
ref-snmp-conf.html	3.77 KB	-r--r--r--
ref-subscriptions-conf.html	8.26 KB	-r--r--r--
security.html	5.96 KB	-r--r--r--
sharing.html	6.64 KB	-r--r--r--
spec-banner.html	4.39 KB	-r--r--r--
spec-browsing.html	4.44 KB	-r--r--r--
spec-cmp.html	37.95 KB	-r--r--r--
spec-command.html	6.42 KB	-r--r--r--
spec-design.html	13.05 KB	-r--r--r--
spec-ipp.html	81.86 KB	-r--r--r--
spec-pdf.html	861 B	-r--r--r--
spec-postscript.html	5.05 KB	-r--r--r--
spec-ppd.html	66.86 KB	-r--r--r--
spec-raster.html	18.77 KB	-r--r--r--
spec-stp.html	3.79 KB	-r--r--r--
standard.html	5.22 KB	-r--r--r--
translation.html	22.96 KB	-r--r--r--
whatsnew.html	11.12 KB	-r--r--r--

Code Editor : kerberos.html

<HTML>

<HEAD>
	<TITLE>Using Kerberos Authentication</TITLE>
	<LINK REL="STYLESHEET" TYPE="text/css" HREF="../cups-printable.css">
</HEAD>
<BODY>

<H1 CLASS="title">Using Kerberos Authentication</H1>

<P>CUPS allows you to use a Key Distribution Center (KDC) for authentication
on your local CUPS server and when printing to a remote authenticated queue.
This document describes how to configure CUPS to use Kerberos authentication
and provides links to the MIT help pages for configuring Kerberos on your
systems and network.</P>

<H2 CLASS="title"><A NAME="REQUIREMENTS">System Requirements</A></H2>

<p>The following are required to use Kerberos with CUPS:</p>

<ol>

<li>Heimdal Kerberos (any version) or MIT Kerberos (1.6.3 or newer)</li>

<li>Properly configured Domain Name System (DNS)
	infrastructure:<ol type='a'>
		<li>DNS server(s) with static IP addresses for all CUPS clients
		and servers or configured to allow DHCP updates to the host
		addresses</li>
		<li>All CUPS clients and servers configured to use the same
		DNS server(s)</li>
	</ol></li>

<li>Properly configured Kerberos infrastructure:<ol type='a'>
		<li>KDC configured to allow CUPS clients and servers to obtain
		Service Granting Tickets (SGTs) for the "ipp" service</li>
		<li>LDAP-based user accounts - both OpenDirectory and
		ActiveDirectory provide this with the KDC</li>
		<li>CUPS clients and servers bound to the KDC and LDAP
		server(s)</li>
	</ol></li>

<li>An "ipp" Service Granting Ticket (SGT) for every CUPS client and
	server</li>

</ol>

<H2 CLASS="title"><A NAME="KRB5">Configuring Kerberos on Your System</A></H2>

<P>Before you can use Kerberos with CUPS, you will need to configure
Kerberos on your system and setup a system as a KDC. Because this
configuration is highly system and site-specific, please consult
the following on-line resources provided by the creators of Kerberos
at the Massachussetts Institute of Technology (MIT):</P>

<UL>

<LI><A HREF="http://web.mit.edu/kerberos/">Kerberos: The Network
	Authentication Protocol</A></LI>

<LI><A HREF="http://web.mit.edu/macdev/KfM/Common/Documentation/faq-osx.html">Kerberos
	on Mac OS X Frequently Asked Questions</A></LI>

</UL>

<P>The Linux Documentation Project also has a HOWTO on Kerberos:</P>

<UL>

<LI><A HREF="http://tldp.org/HOWTO/html_single/Kerberos-Infrastructure-HOWTO/">Kerberos
	Infrastructure HOWTO</A></LI>

</UL>

<H2 CLASS="title"><A NAME="CUPS">Configuring CUPS to Use Kerberos</A></H2>

<P>Once you have configured Kerberos on your system(s), you can then
enable Kerberos authentication by selecting the <tt>Negotiate</tt>
authentication type. The simplest way to do this is using the
<tt>cupsctl(8)</tt> command:</P>

<PRE CLASS="command">
<KBD>cupsctl DefaultAuthType=Negotiate</KBD>
</PRE>

<P>You can also enable Kerberos from the web interface by checking the
<VAR>Use Kerberos Authentication</VAR> box and clicking <VAR>Change
Settings</VAR>:</P>

<PRE CLASS="command">
http://localhost:631/admin
</PRE>

<P>After you have enabled Kerberos authentication, use the built-in
"authenticated" policy or your own custom policies with the printers you
will be sharing. See <a href="policies.html">Managing Operation Policies</a>
for more information.</P>

<H2 CLASS="title"><A NAME="IMPLEMENT">Implementation Information</A></H2>

<P>CUPS implements Kerberos over HTTP using GSSAPI and the service name
"ipp". Because of limitations in the HTTP GSSAPI protocol extension, only
a single domain/KDC is supported for authentication.</P>

<P>When doing printing tasks that require authentication, CUPS requests a
single-use "ticket" from your login session to authenticate who you are.
This ticket gives CUPS a username of the form "user@REALM", which is then
converted to just "user" for purposes of user and group checks.</P>

<P>In order to support printing to a shared printer, CUPS has to ask the KDC
for a copy of your credentials (this is called delegation) that can be sent to
the remote server for authenticatation. Delegation only works when the system
has a stable hostname which maps to the current address of the system, which
is why you need a static IP address or DHCP that updates the DNS entry for your
system.</P>

</BODY>
</HTML>

${this.title}

Code Editor : kerberos.html