Article

(View Disclaimer)

Problem:

Getting the following errors when trying to create an iPrint driver store:

Authorization Required
IPP Error: 0xF0191
HTTP Error: 401

Error: "HTTP 401 - Unauthorized." when uploading drivers to the Broker.

Unable to access secure page https://ipaddress/ipps

Solution:

The default Apache iPrint configuration is set up to do an anonymous bind LDAP search to verify the user credentials. This will obviously fail when you have restricted public access to your tree. So to solve this problem we added two lines to the iPrint SSL apache configuration to make it use an authenicated bind to lookup user details and authenticate the user.

In /etc/opt/novell/iprint/httpd/conf/iprint_ssl.conf we added the following lines just below the AuthName line:

AuthName "your tree name"
AuthLDAPBindDN cn=username,o=novell
AuthLDAPBindPassword userpassword

The user used in the AuthLDAPBindDN needs to have browse privileges and read rights on the uniqueID attribute of user objects in your tree.

EXAMPLE:

The complete configuration file should look like this:

<IfModule mod_ipp.c>
      <LocationMatch ^/(ipps|idss|[Pp][Ss][Mm][Ss][Tt][Aa][Tt][Uu][Ss])($|/)>
        #SSLRequireSSL
        Require valid-user
        Order deny,allow
        Allow from all
        AuthType Basic
        AuthName "HR_TREE"
        AuthLDAPBindDN cn=<LDAPUSER>,o=novell
        AuthLDAPBindPassword <PASSWORD>
        AuthLDAPURL "ldaps://localhost/o=hr???(objectClass=user)"
        AuthLDAPRemoteUserIsDN on
        <IfModule mod_auth_ldap.c>
          AuthLDAPEnabled Off
        </IfModule>
        AuthLDAPDNAuthoritative On
        AuthLDAPAllowDNAuth On
      </LocationMatch>
</IfModule>

Environment:

Novell OES/Linux SP2
Novell iPrint 5.1

Disclaimer: As with everything else at Cool Solutions, this content is definitely not supported by Novell (so don't even think of calling Support if you try something and it blows up).

It was contributed by a community member and is published "as is." It seems to have worked for at least one person, and might work for you. But please be sure to test, test, test before you do anything drastic with it.