Error: "HTTP 401 - Unauthorized." when uploading drivers to the Broker

6. PHP is installed on the server.
PHP has a conf file that is loaded through the httpd.conf file using an include statement. (include sys:\Apache2\conf\mod_php.conf). The PHP apache configuration file loads other NLMS, one of which is PHP_LDAP.NLM. PHP_LDAP and AuthLDAP (AuthLDAP is used by iPrint) conflicts with each other.

No code changes are planned to be made to address this error. Determine which condition is causing the 401 error in your environment and make the change suggested below to resolve the problem. The below suggestion numbers correlate to the above cause numbers:

1. Duplicate CN's
Create a unique user in the tree that is not found in any other context. Give that user rights to manage the Broker and Manager. Log into iManager with that user to upload drivers or create Printer Driver Profiles.

2. The uniqueID attribute is not set on the user.
For more information to see if the that attribute is set for the user and how to populate the uniqueID, see TID 3110036.

3. The uniqueID attribute cannot be found during the LDAP query.
Reason 1: Rights to find the uniqueID - Verify that [PUBLIC] has READ and COMPARE rights for the uniqueID:
a. Launch ConsoleOne
b. Right click on the Organization select Trustees of this Object.
c. Highlight [PUBLIC] in the trustee list, select Assigned Rights.
d. Click on Add Property, check the box next to Show all properties, then scroll down the list until you find uniqueID.
e. Highlight uniqueID and click OK.
f. Check COMPARE and READ and Inheritable under Rights, then click OK

These rights can also be obtained by creating a proxy user for the LDAP Group Object:
a. Go to iManager: https://ipaddress/nps/iManager.html
b. Choose "eDirectory Administration"
c. Choose "Create Object" - create a user that has no rights and no password
d. Choose "Modify Object" - browse to the LDAP Group object (resides in the
same container as the server object) for the server that is hosting iPrint.
Note: Each server has an LDAP Group object named "LDAP Group - [ServerName]".
e. Under the "Authentication Options", browse to the user created in Step c. Click Apply.

Reason 2: CN doesn't equal the UID - Compare the CN value to the uniqueID attribute by going to the properties of the user and choosing the "Other" tab. If there is a difference, then change the uniqueID value to match the CN.

Reason 3: Multiple Organization objects - Modify the sys:\Apache2\conf\ipp.conf file from:
AuthLDAPURL "ldaps://[IPorDNSofPrintServer]/O=[OrganizationName]???(objectClass=user)"

to

AuthLDAPURL "ldaps://[IPorDNSofPrintServer]/???(objectClass=user)"
Restart Apache to make that take affect. (ap2webdn.ncf and ap2webup.ncf)

4. Certificate Timeout.
In the SYS:\Apache2\iprint\ipp.conf, change:
AuthLDAPURL ldaps://[DNS]/O=[OrganizationName]???(objectClass=user)
to
AuthLDAPURL ldaps://localhost/O=[OrganizationName]???(objectClass=user)

Use the word localhost. Restart Apache to make that take affect. (ap2webdn.ncf and ap2webup.ncf)

5. Resolve the certificate problem.
There are two types of certificate problems.
a. Rootcert.der certificate problem. Export the Self Signed Certificate from ConsoleOne. See the NOTE section below titled: "How to export the Self Signed Certificate using ConsoleOne".
b. SSL Certficate problem. See the NOTE section below title: "How to export the SSL Certificate using ConsoleOne."

6. PHP is installed on the server.
Any one of the following three changes will resolve this problem.

a. If PHP is not needed on the server, simply comment out
the "include sys:\Apache2\conf\mod_php.conf" statement
from sys:\Apache2\conf\httpd.conf. Restart Apache.
b. Copy (not move) SYS:/PUBLIC/rootcert.der to SYS:\PHP5\Certs\.
c. Change the value of the ldap.ssl_cert_dir variable in the PHP.INI file
to point to SYS:\PUBLIC. Restart Apache.

7. Use NWAdmin to upload drivers.
NWAdmin does not use the iPrint client to upload drivers and therefore the above problems will not be encountered. Novell does not recommend this as a solution, but as a temporary workaround until the real cause and resolution is determined. To upload drivers using NWAdmin, you must have the Novell Client installed with the NDPS component. You must also launch the executable with a /disableTLSMgr switch. For example: SYS\PUBLIC\WIN32\nwadmn32.exe /disableTLSMgr.

8. Install iPrint client version 3.x on administrator workstations.
The iPrint client prior to version 4.x does not perform the additional authentication to upload drivers to the Broker using iManager. Novell does not recommend this as a solution, but as a temporary workaround until the real cause and resolution is determined. When using the 3.x iPrint client, the rights are obtained through the Public trustee assignment to the XFER directory.