Chapter 9. Using Samba to print to a Windows print server with Kerberos authentication

With the samba-krb5-printing wrapper, Active Directory (AD) users who are logged in to Red Hat Enterprise Linux (RHEL) can authenticate to Active Directory (AD) by using Kerberos and then print to a local CUPS print server that forwards the print job to a Windows print server.

The benefit of this configuration is that the administrator of CUPS on RHEL does not need to store a fixed user name and password in the configuration. CUPS authenticates to AD with the Kerberos ticket of the user that sends the print job.


Red Hat supports only submitting print jobs to CUPS from your local system, and not to re-share a printer on a Samba print server.


  • The printer that you want to add to the local CUPS instance is shared on an AD print server.
  • You joined the RHEL host as a member to the AD.
  • CUPS is installed on RHEL, and the cups service is running.
  • The PostScript Printer Description (PPD) file for the printer is stored in the /usr/share/cups/model/ directory.


  1. Install the samba-krb5-printing, samba-client, and krb5-workstation packages:

    # dnf install samba-krb5-printing samba-client krb5-workstation
  2. Optional: Authenticate as a domain administrator and display the list of printers that are shared on the Windows print server:

    # smbclient -L -U administrator@AD_KERBEROS_REALM --use-kerberos=required
    	Sharename       Type      Comment
    	---------       ----      -------
    	Example         Printer   Example
  3. Optional: Display the list of CUPS models to identify the PPD name of your printer:

    lpinfo -m
    samsung.ppd Samsung M267x 287x Series PXL

    You require the name of the PPD file when you add the printer in the next step.

  4. Add the printer to CUPS:

    # lpadmin -p "example_printer" -v smb:// -m samsung.ppd -o auth-info-required=negotiate -E

    The command uses the following options:

    • -p printer_name sets the name of the printer in CUPS.
    • -v URI_to_Windows_printer sets the URI to the Windows printer. Use the following format: smb://host_name/printer_share_name.
    • -m PPD_file sets the PPD file the printer uses.
    • -o auth-info-required=negotiate configures CUPS to use Kerberos authentication when it forwards print jobs to the remote server.
    • -E enables the printer and CUPS accepts jobs for the printer.


  1. Log into the RHEL host as an AD domain user.
  2. Authenticate as an AD domain user:

    # kinit domain_user_name@AD_KERBEROS_REALM
  3. Print a file to the printer you added to the local CUPS print server:

    # lp -d example_printer file