How to really add a Printer / how to verify the printer setup on the UCS side

UCS - Univention Corporate Server
, ,
#1

Hello There,

I am hitting this topic for the first time - in other words I am total rookie on shared printers and so on. I am thankful for any sort of help! Anyway. I followed the instructions and:

  • installed CUPS app
  • added our printer as IP Client
  • added our printer as Printer

Screenshot from 2023-03-31 11-57-57

When I visit https://ucs.werkbank.intranet:631 I arrive at the dashboard of CUPS and I can see the printer. From there I can issue to print a test page. I even managed to add the printer to an Ubuntu system and run a print command from there.

Today we totally disabled any sort of Authentication on the printer itself. We even managed to install the root ca certificate from our Domain Controller on the Printer. But no matter if we were trying to use ipp:// or http:// - both services are enabled on the printer - all we got was that found in /var/log/cups/error_log:

E [31/Mar/2023:08:50:20 +0100] [Client 215] Unable to encrypt connection: A TLS fatal alert has been received.
E [31/Mar/2023:08:50:20 +0100] [Job 5] Druckerstatus konnte nicht ermittelt werden:
E [31/Mar/2023:08:50:25 +0100] [Client 217] Unable to encrypt connection: A TLS fatal alert has been received.

Is there any way to find out if the setup on the UCS is correct such that we can concentrate to find the issue on the printer side?

The printer supports LDAP, do we need to enable it in order for this to work?

When I try to delete a Job on the CUPS Dashboard, it tells me that I am not allowed to do so, even though I am logged in with a Administrator account. Are there any permissions/user settings we have to make in order to be able to audit the printer on the ucs side?

When I try to delete Print Jobs from within the UCS Dashboard, I am getting this error:

Screenshot from 2023-03-31 12-11-52

Does the UCS try authenticate in some way on the printer? Are the credentials from the user passed over to the printer, or does UCS use a different account for that?

Thanks for any hints.

#2

Somehow we have managed to add the printer to the ucs. I was some trail an error finding the right PPD file. But now there is another Problem: The Printers should be login protected. So in the Access Control Panel we set it like that:

Screenshot from 2023-04-05 14-52-11

With that setup no windows client can print anymore. On a linux Box that works fine, once the user has pressed the »PRINT« button, the popup asking the credentials shows up and everything works. Windows clients can only Print if the protection is disabled.

Additionally I have installed the samba4 and adconnector but that doesn’t change a thing: The printer doesn’t show up.

What might be the catch here??

#3

Hi wb-we,

I wonder if you had any luck with setting up the printer. I spent almost a week trying to make sense of the PPD, Windows and CUPS configuration that’s woven into UCS but I still can’t make one of our printers to work.

Cheers

#4

Hi @dzidek23 ,

the printer thingy went too far for us. The main Problem we were facing were: making windows use the cups printer correctly. What we wanted to achieve was a password protection for the printer, based on the UCS login, such that each User has to type credentials in order to print. On Linux that worked without an issue, but not on windows, since windows uses the credentials from the windows login and sends those to the printer. We do not want to setup a windows domain login, because we are a co-working space and we just want to provide some basic infrastructure like wlan, file sharing and printing. But printing didn’t make it. Since we are all volunteers here, there isn’t too much time to investigate all the printer oddities, but if you found a working solution, we would be interested!

Cheers.

#5

Good morning @wb-we,

Well, I got to the point where the printers I wanted are working (not necessarily the way I would like them to, but they do). A combination of CUPS shares and drivers preinstalled on client machines was a solution in my scenario. I’m lucky as we don’t allow BYOD and all clients are domain joined so no authentication or accounting is required.

Had a quick look at CUPS and passwords and here are some interesting finds which might be a solution for you. I could not verify them as my CUPS configuration doesn’t have user auth enabled:

  1. printing - How can I use CUPS' basic authentication from a windows client? - Super User
  2. Configuring CUPS to password protect IPP shared printers with windows compatibilty - Unix & Linux Stack Exchange

@scheinig
I feel the CUPS faff could affect how some users see UCS in general. Printing is important on a network with central management so it should either work or not be mentioned at all. After a week spent trying to make the printers to work, I’d rather not have seen the app available in UCS software centre :wink: (In general others don’t mention printing or CUPS at all, look at Zentyal or Nethserver)

Best of luck

#6

Hello @dzidek23 ,

thanks for sharing your findings! I have already been there and it did not work, at least solution (1). For (2) I didn’t have the time to try and, to be honest, I hoped that this configuration part would be what UCS does.

In my experience: When digging into that printer topic, I literally started to smell that this topic is as old as computers and that a whole landscape of businesses has grown around it. I feel that there is no real will to make it work consistent across plattforms from all parties involved. That’s my personal impression: As long as you are in one ecosystem it works fine, otherwise trouble is just around the corner.

Cheers.

Mastodon