From 9c6f10b9f85691cc6796ed5ed9a61834feacb423 Mon Sep 17 00:00:00 2001
From: Daniel Milnes <daniel.milnes@lmax.com>
Date: Mon, 16 Feb 2026 20:25:49 +0000
Subject: [PATCH] Allow setting the DefaultAuthType

---
 REFERENCE.md                    |  9 +++++++++
 manifests/init.pp               |  1 +
 spec/classes/init_spec.rb       | 16 ++++++++++++++++
 templates/cupsd/_directives.erb |  2 +-
 4 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/REFERENCE.md b/REFERENCE.md
index 757df75f..8b61baee 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -100,6 +100,7 @@ The following parameters are available in the `cups` class:
 * [`max_jobs_per_user`](#-cups--max_jobs_per_user)
 * [`preserve_job_files`](#-cups--preserve_job_files)
 * [`preserve_job_history`](#-cups--preserve_job_history)
+* [`default_auth_type`](#-cups--default_auth_type)
 
 ##### <a name="-cups--access_log_level"></a>`access_log_level`
 
@@ -405,6 +406,14 @@ Specifies  whether  the job history is preserved after a job is printed.
 
 Default value: `undef`
 
+##### <a name="-cups--default_auth_type"></a>`default_auth_type`
+
+Data type: `Enum['Basic', 'Negotiate']`
+
+
+
+Default value: `'Basic'`
+
 ### <a name="cups--packages"></a>`cups::packages`
 
 Private class
diff --git a/manifests/init.pp b/manifests/init.pp
index bb8588ae..d41b321a 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -75,6 +75,7 @@
   Optional[Variant[String, Array[String]]] $browse_local_protocols = undef,
   Optional[Boolean]                        $browse_web_if          = undef,
   Boolean                                  $browsing               = false,
+  Enum['Basic', 'Negotiate']               $default_auth_type      = 'Basic',
   Optional[String]                         $default_queue          = undef,
   Variant[String, Array[String]]           $listen                 = ['localhost:631', '/var/run/cups/cups.sock'],
   Optional[Variant[String, Hash]]          $location               = undef,
diff --git a/spec/classes/init_spec.rb b/spec/classes/init_spec.rb
index 655d3d40..354b8164 100644
--- a/spec/classes/init_spec.rb
+++ b/spec/classes/init_spec.rb
@@ -853,5 +853,21 @@
         it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{^WebInterface No$}) }
       end
     end
+
+    describe 'default_auth_type' do
+      let(:facts) { any_supported_os }
+
+      context 'when not set' do
+        let(:params) { {} }
+
+        it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{^DefaultAuthType Basic$}) }
+      end
+
+      context 'when set to Negotiate' do
+        let(:params) { { default_auth_type: 'Negotiate' } }
+
+        it { is_expected.to contain_file('/etc/cups/cupsd.conf').with(content: %r{^DefaultAuthType Negotiate$}) }
+      end
+    end
   end
 end
diff --git a/templates/cupsd/_directives.erb b/templates/cupsd/_directives.erb
index 9d17ea8e..6ae65cb6 100644
--- a/templates/cupsd/_directives.erb
+++ b/templates/cupsd/_directives.erb
@@ -4,7 +4,7 @@
 <%= COMMENT_OUT if @browse_local_protocols.nil? -%>BrowseLocalProtocols <%= @browse_local_protocols.is_a?(Array) ? @browse_local_protocols.join(' ') : @browse_local_protocols %>
 <%= COMMENT_OUT if @browse_web_if.nil? -%>BrowseWebIF <%= (@browse_web_if ? 'Yes' : 'No') %>
 <%= COMMENT_OUT if @browsing.nil? -%>Browsing <%= (@browsing ? 'Yes' : 'No') %>
-DefaultAuthType Basic
+<%= COMMENT_OUT if @default_auth_type.nil? -%>DefaultAuthType <%= @default_auth_type %>
 <% unless @listen.empty? -%>
 <%   [@listen].flatten.each do |l| -%>
 <%=    "Listen #{l}" %>