HTTP 401 or 500 Errors managing Linux iPrint objects

Error: Create Driver Store Failure
Authorization Required
IPP Error: 0xF0191
HTTP Error: 401

or

Internal Server Error
IPP Error: 0xF01F4
HTTP Error: 500

2. Duplicate uniqueID attributes
Create a unique user in the tree that is not found in any other context. Give that user rights to the container where you want to create the Driver Store and Manager. Log into iManager with that user to manage iPrint.

3. The uniqueID attribute cannot be found during the LDAP query.
a. CN doesn't equal the UID - Compare the CN value to the uniqueID attribute by going to the properties of the user and choosing the "Other" tab. If there is a difference, then change the uniqueID value to match the CN. After changing, verify that the new uniqueID is acutally unique using the command "Cause 2"

b. Multiple Organization objects - Modify
the /etc/opt/novell/iprint/httpd/conf/iprint_ssl.conf file from:

AuthLDAPURL"ldaps://[IPorDNSofPrintServer]/[LDAPSearchBase]???(objectClass=user)"
to
AuthLDAPURL "ldaps://[IPorDNSofPrintServer]/???(objectClass=user)"

Restart Apache to make that take affect. (rcapache2 restart)

4. Problem Contacting LDAP Server
In the /etc/opt/novell/iprint/httpd/conf/iprint_ssl.conf, change:
AuthLDAPURLldaps://[DNS]/O=[YourOrganizationName]???(objectClass=user)
to
AuthLDAPURLldaps://[IP_OF_SERVER]/O=[YourOrganizationName]???(objectClass=user)

Use the word localhost. Restart Apache to make the change take effect. (rcapache2 restart)

5. Certificate Invalid, Expired, or Untrusted
The iPrint authentication relies on a secure connection to the LDAP server specified in /etc/opt/novell/iprint/httpd/conf/iprint_ssl.conf. This secure connection requires the /etc/opt/novell/certs/SSCert.pem to be valid. (Note: The location of SSCert.pem for OES 1 is /etc/opt/novell/.)

There are three methods to fixing or working around this problem:

b. Change the certificate used in the iPrint authentication
- Modify the following line in /etc/opt/novell/httpd/conf.d/iprint_g.conf from
LDAPTrustedCA /etc/opt/novell/certs/SSCert.pem
to
LDAPTrustedCA /etc/ssl/servercerts/servercert.pem
- Restart apache
rcapache2 restart

1. Delete the SSL CertificateDNS, SSL CertificateIP & SAS object of the server in question.
2. From the Terminal window of the server in question run ndsconfig upgrade.

1.The uniqueID attribute is not set on the user.
Users created by iManager or ConsoleOne will have a uniqueID attribute set for each account. By default, the uniqueID string will match the CN. For example, the uniqueID for admin.acct is admin. The LDAP authentication performed by the iPrint client relies on this uniqueID attribute. If the attribute is not present, then the authentication will fail. Users created with NWAdmin will not have a uniqueID. The results to the above search will let you know if that uniqueID exists.

2.Duplicate UniqueID attributes
Because iPrint's LDAP authentication doesn't use context, a user's uniqueID attribute must be unique. For example, in NDS, you might have admin.acct and admin.marketing as two different users, but if both have the uniqueID of "admin" then neither could log in to iPrint with the name "admin" since the server wouldn't know which one was trying to log in. A 401 error is returned when the iPrint client queries LDAP for admin and receives multiple responses. You can determine if the uniqueID exists more than once in your tree by doing the following LDAP search.

ldapsearch -b [LDAPSearchBase] -x -a always -H ldaps://%5BDNSorIPofIPRINTserver/] '(&(uid=[USERNAME])(objectClass=user))'

The items in brackets [ ] must be replaced with the value from your environment. Below is a example:

ldapsearch -b o=novell -x -a always -H ldaps://10.0.1.9/ '(&(uid=admin)(objectClass=user))'

3. The uniqueID attribute cannot be found during the LDAP query.
Before the authentication can occur, the user's uniqueID attribute must be found by an LDAP query. Below lists 2 reasons the uniqueID (UID) may not be found:

a. CN doesn't equal the UID
If the value for the CN does not match the value of the uniqueID, then the UID will not be found during the LDAP lookup. Unmatching CN's and UID's will occur only if the CN or UID was manually changed.

b. Multiple Organization objects or search bases
By default, the /etc/opt/novell/iprint/httpd/conf/iprint_ssl.conf specifies the Organization object or other search bases that will be searched to find the user that logged into iManager. For example, if the tree has multiple O's (Organization objects), then users only in the O listed in the iprint_ssl.conf will be searched. Users outside of that O will see the 401 error.

4.Problem Contacting LDAP Server
/etc/opt/novell/iprint/httpd/conf/iprint_ssl.confreferences the LDAP server used for authentication by DNS name. If the DNS lookup takes longer than expected, the server is unreachable or down, or the LDAP service is not running on the server, a 401 error will be returned.

Look to the bottom of the output returned from the above command.

The output from a valid certificiate will end with:
Verify return code: 0 (ok)

Note: Even if the status shows OK, be sure to check the DNS name returned in the certificate. If the DNS name in the certificate doesn't match the server's true name, then you must resolve this problem following the steps in the FIX section of this TID.

The output from an expired certificate will end with:
Verify return code: 10 (certificate has expired)

1. In iManger go to  Novell Certificate Access | Server Certificates.
2. Browse and select the suspected Server and check mark SSL CertificateDNS and click on Export.
3. From the Certificates Drop Down list choose SSL CertificateDNS and Uncheck Export private key.
4. Export format should be DER click on Next.
5. Save the Exported Certificate.
6. Go to eDirectory Maintenance | Import Convert Export Wizard.
7. Select Export data to a file on disk and click on Next.
8. Provide the IP address of the server in question and use port 636.
9. Browse and select the Exported Certificate file.
10. Choose Authenticated login and provide Admin credentials and click on Next.
11. Provide Base DN as O=Organization (Replace Organization with the name of your Organzation object in eDirectory).
12. Select Base and click on Next.
13. Keep defaults for rest of the options.