What's the best way to do authentication on a remote printer?

[xiaowen581]

In our use case, we need to add a network printer using lpadmin (requiring Basic/Digest authentication), and then print through the CUPS API. However, we have not found a suitable authentication method in the existing CUPS API.

After studying the related code of CUPS, I learned that the IPP backend supports two methods for passing username and password:

Method 1: User:password included in the device URI.
Method 2: Obtain AUTH_USERNAME and AUTH_PASSWORD from environment variables.

Using Method 2, adding [ATTR text "auth-info" USERNAME, PASSWORD] in the ".test" file for ipptool successfully conducted printing.

{ 
    VERSION 2.0 
    OPERATION Print-Job 
    REQUEST-ID 42 
    GROUP operation-attributes-tag 
    ATTR charset "attributes-charset" "utf-8" 
    ATTR naturalLanguage "attributes-natural-language" "en" 
    ATTR uri "printer-uri" "ipp://localhost:631/printers/brother_auth" 
    ATTR name "requesting-user-name" "root" 
    ATTR mimeMediaType "document-format" "image/png" 
    ATTR text "auth-info" "ABC", "0001" 
    FILE "/home/user/print_test.png" 
}

The above two methods are not clearly documented, but no more suitable authentication methods could be found.

My questions:
· Does Method 2 mentioned above pose any security risks? Is it in line with the expectations of CUPS developers?
· The existing "cupsStartDestDocument" does not include "auth-info" in the request. Is there a possibility that "auth-info" will be added in the future?

[xiaowen581]

Method 3: send CUPS-Authenticate-Job IPP request
appears to be the usage recommended by CUPS.