Repository navigation
Add OAuth support to cupsd #246
Description
This bug is a placeholder for adding OAuth server support to cupsd and figuring out the right default callbacks on different platforms.
{{ message }}
This bug is a placeholder for adding OAuth server support to cupsd and figuring out the right default callbacks on different platforms.
Activity
michaelrsweet commentedon Sep 13, 2021
Related to issue #100 which adds the basic client callback support in libcups.
ShivanshCharak commentedon Mar 1, 2023
Okay so by authorization you mean when we open the localhost:631 it asks for username and password of the machine there we have to add authorization?
michaelrsweet commentedon Mar 2, 2023
@ShivanshCharak No, this is to integrate support for using OAuth/OpenID with CUPS - on the client side to open a browser window to authorize access, and on the server (cupsd) side to "introspect" the access token to get the authorized user name.
In short, an alternative to the usual username + password stuff.
yarons commentedon Mar 2, 2023
It's easier to manage from security perspective by allowing having a single identity per employee and auditing (SAML is a good example, think about controlling the paper type and color/b&w centrally in that case).
OpenID Connect is usually for public services authentication such as Google, Facebook, etc., I don't think it's mandatory for such project.
ShivanshCharak commentedon Mar 3, 2023
@michaelrsweet okay so you mean by using openid we have to do Authorization by poping up the window there we have to give our detail like email or password and by using tge system will give us access
michaelrsweet commentedon Mar 7, 2023
@ShivanshCharak I appreciate the enthusiasm!
We are finalizing some OAuth things over in the Printer Working Group now, and I hope to post an initial document for discussion this week (I'll add a link here).
Aside from the logistics of what bits of OAuth/OpenID to support, there are also a bunch of security things to think about in implementation to prevent arbitrary programs from collecting access tokens.
michaelrsweet commentedon Apr 5, 2024
OK, so I've been noodling some things for how to implement this:
CUPS_HTTP_AUTHORIZATIONenvironment variable to specify the Authorization: header to use for non-interactive usagecupsoauth?) to manage the encrypted store (get/set/clear)OAuthServer URIdirective andAuthType Bearervalue to cupsd.conf, with requirement for OpenID/RFC 8414 metadata and JWT usage so that tokens can be introspected locallyFor GUI applications, the CPDB UI will need to handle bringing up the OAuth authorization page and collecting the bearer token.
michaelrsweet commentedon Apr 2, 2025
A lot of this is already implemented. What remains is the server side, so re-titling...
[-]OAuth Server and Default Callback Support[/-][+]Add OAuth support to cupsd[/+]michaelrsweet commentedon Apr 14, 2025
Some details as I'm getting ready to add this:
OAuthGroup NAME FILENAME: File lists JWT "email" or "sub" values that should map to "@" groups, one per lineOAuthServer https://hostname/PATH: URL for authorization serverOAuthScopes SCOPE [... SCOPE]: Lists the scopes to ask for, defaults to all of the supported scopes if not specified[Default]AuthType Bearerdirective to enable OAuthmichaelrsweet commentedon Apr 16, 2025
Created a sub-issue to add proper support for OAuth authorization through the web interface (requires redirection - localhost will be easier than arbitrary servers...)
More OAuth additions (Issue #246):
Add OAuth support to cupsdIsAuthorized (Issue #246)
Set job-originating-user-xxx attributes using OAuth values when possi…
Clear realname, email, and autherror fields between requests (Issue #246
Add CUPS_OAUTH_SCOPES, CUPS_OAUTH_SERVER, and HTTP_AUTHORIZATION envi…
Use HTTP_AUTHORIZATION in CGI programs (Issue #246)
michaelrsweet commentedon Apr 16, 2025
Another sub-issue for shared queues.
OK, basic support is pushed now, requires testing (obviously) and I'll work on some documentation as well. The basics are as follows:
Configuration
Add
OAuthServerto "cups-files.conf" with the URL of your OAuth authorization server. For example, to use Microsoft's Entrada ID:Create a "SYSTEM.txt" file in "/etc/cups" and list any emails you want to have admin access. Then add an
OAuthGroupline to "cups-files.conf":michaelrsweet commentedon Apr 30, 2026
Closing this one, remaining tasks are separate issues.