Authentication in CUPS (IPP) and sane (eSCL)?

Charles Curley

unread,

Oct 4, 2021, 5:50:05 PM10/4/21

to

I have just bought an HP LaserJet MFP M232-M237 - IPP Everywhere. It
will let me require authentication for IPP clients. This would be a
nice thing to have in a SOHO environment, and a requirement in any
large institution.

I can set the printer easily enough. What I haven't been able to do is
tell CUPS to authenticate itself. How do I do that?

Similarly for eSCL Authentication and sane?

Searching has been less than elucidating.

--
Does anybody read signatures any more?

https://charlescurley.com
https://charlescurley.com/blog/

Brian

unread,

Oct 5, 2021, 9:20:04 AM10/5/21

to

On Mon 04 Oct 2021 at 15:48:14 -0600, Charles Curley wrote:

> I have just bought an HP LaserJet MFP M232-M237 - IPP Everywhere. It
> will let me require authentication for IPP clients. This would be a
> nice thing to have in a SOHO environment, and a requirement in any
> large institution.
>
> I can set the printer easily enough. What I haven't been able to do is
> tell CUPS to authenticate itself. How do I do that?
>
> Similarly for eSCL Authentication and sane?
>
> Searching has been less than elucidating.

In which manual section, or on which page, is access control described?

--
Brian.

Charles Curley

unread,

Oct 5, 2021, 12:50:05 PM10/5/21

to

On Tue, 5 Oct 2021 14:16:10 +0100
Brian <ad...@cityscape.co.uk> wrote:

> In which manual section, or on which page, is access control
> described?

I take it you mean for the printer, not CUPS. For the printer, it is on
the embedded web server.

https://hpm234ethernet.... -> Networking -> Advanced.

It isn't described, but the available options are to require IPP or
eSCL authentication, and if so to set a user name and password. Both
have the annotation,

Users printing from mobile devices will be required to provide this
Name/password combination. Username and Password can contain any
printable characters except "()<>@,;:\/[]?={}"

I don't see anything in the User Guide.

Brian

unread,

Oct 5, 2021, 3:10:03 PM10/5/21

to

On Tue 05 Oct 2021 at 10:17:06 -0600, Charles Curley wrote:

> On Tue, 5 Oct 2021 14:16:10 +0100
> Brian <ad...@cityscape.co.uk> wrote:
>
> > In which manual section, or on which page, is access control
> > described?
>
> I take it you mean for the printer, not CUPS. For the printer, it is on
> the embedded web server.
>
> https://hpm234ethernet.... -> Networking -> Advanced.
>
> It isn't described, but the available options are to require IPP or
> eSCL authentication, and if so to set a user name and password. Both
> have the annotation,
>
> Users printing from mobile devices will be required to provide this
> Name/password combination. Username and Password can contain any
> printable characters except "()<>@,;:\/[]?={}"

Thanks for the detail.

The emphasis is on mobile devices. I wonder why they are singled out?
Interesting.

I would set a Username and Password and see how you go on printing and
scanning using CUPS and SANE and your iPhone.

> I don't see anything in the User Guide.

Neither do I. Expecting explanations in a Guide is optimistic, but a
mentiom would not be out of place.

A single, unique Username/Password combination is all that is required.
What is the liklihood of its remaining unknwn in an orgaisation for very
long? Security doesn't appear to be enhanced.

--
Brian.

Charles Curley

unread,

Oct 5, 2021, 4:10:02 PM10/5/21

to

On Tue, 5 Oct 2021 20:01:16 +0100
Brian <ad...@cityscape.co.uk> wrote:

> The emphasis is on mobile devices. I wonder why they are singled out?
> Interesting.
>
> I would set a Username and Password and see how you go on printing and
> scanning using CUPS and SANE and your iPhone.

Good idea. The app on the iPhone reports that eSCL is not supported.
Well, that was good for a laugh for the day. (At least I know that it
appears to work on the printer.)

Brian

unread,

Oct 6, 2021, 8:00:03 AM10/6/21

to

On Tue 05 Oct 2021 at 13:43:07 -0600, Charles Curley wrote:

> On Tue, 5 Oct 2021 20:01:16 +0100
> Brian <ad...@cityscape.co.uk> wrote:
>
> > The emphasis is on mobile devices. I wonder why they are singled out?
> > Interesting.
> >
> > I would set a Username and Password and see how you go on printing and
> > scanning using CUPS and SANE and your iPhone.
>
> Good idea. The app on the iPhone reports that eSCL is not supported.
> Well, that was good for a laugh for the day. (At least I know that it
> appears to work on the printer.)

Even if CUPS could handle sending Username/Password (and I doubt it
can), the facilty is aimed a mobile devices.

BTW: why use HPLIP? This is an Everywhere printer and supported by
the printing system on buster and bullseye.

--
Brian.