Since it seems that getting Negotiate authentication is difficult/impossible to achieve with a local CUPS spooler on each client (see CUPS Negotiate authentication woes), I am now looking at an alternative method to try and get a workable print server with logging and authentication configured.
Ideally, each client on the network would run a CUPS spooler, and then certain printers from the master server are configured on the clients (so clients in Room 1 would get the printers from Room 1). With Basic AuthType this works, showing a username/password dialog when trying to print. Yet with Negotiate authentication (which would be necessary for single-sign-on with Kerberos) it doesn't.
However, if I use client.conf to point the client at the master CUPS server, Negotiate authentication starts to work properly. The issue now is that all print queues on the CUPS server are visible to every client - not wanted as printing across the site is not good. So the question is - how can you 'hide' print queues from clients, when they point directly at the CUPS server that manages every printer in the network?
I am going to leave this question slightly more open, by also asking for any more alternative methods to a CUPS printer server solution. As mentioned above, we use a single master print server for the entire network, simplifying logging and authentication. Would a different configuration be better suited for the task? How do big organizations do it? I cannot believe that each client can see every printer on the network in an enterprise or the like.
Of course, it may be that CUPS isn't what we need either. We do run Samba4 as an Active Directory server at the site, so perhaps printing could be achieved through that. The requirements are full logging (preferably centralized) and authentication.
CUPS version 1.5.3, running Ubuntu 12.04 LTS on both server and clients.
