Papercut - strange issue with Macs

[Norphy]

I don't know if anyone has ever come across this one before?

 

I'm trying to set up some printer queues on my Macs. These queues are controlled by Papercut.

 

I've already worked around one issue where the Macs don't like printing to queues with Type-4 drivers, that's not an issue. This one is a bit stranger.

 

When I create a printer queue on the Mac to map to the Windows printer queue through System Preferences, it all works fine. I print a job, the print app pops up then the Papercut client cuts in and asks which account I want it to charge. Brilliant, great. However, creating a queue on each Mac doesn't really scale when you've got 80+ of them to worry about. So I want to create the queues using the CUPS CLI through Terminal instead so I can script it.

 

When I try to print to a queue created this way, the job goes into the queue but then it sits there asking for authentication. The Papercut client doesn't kick in, the job just sits there. Sometimes, the print queue asks for a username and password but it makes no difference when it does. I even tried creating an macOS mobileconfig profile to see if that made any difference but the issue remains.

 

Looking at the CUPS admin page, the printers are set up identically so I really can't see why this is happening. Has anyone seen this before or should I give up trying to print to Windows queues and just set up CUPS and a secondary Papercut server on a Linux server instead?

[Arthur]

When I try to print to a queue created this way, the job goes into the queue but then it sits there asking for authentication.

IIRC, the key to avoiding the authentication popup is to set auth-info-required to negotiate.

 

These are the lpadmin commands I used for our Mac print queues (which print to a Windows Server 2016 print server running PaperCut MF)...

 

/usr/sbin/lpadmin \
-p Colour_6052 \
-D "Colour" \
-L "Any MFD in school" \
-P "/Library/Printers/PPDs/Contents/Resources/Kyocera TASKalfa 6052ci.PPD" \
-v "smb://printserver.schooldomain.net/Colour" \
-o Option17=DF770 \
-o Option18=HardDisk \
-o Option19=One \
-o Option21=true \
-o Option22=true \
-o PageSize=A4 \
-o PageMediaType=Plain \
-o MediaType=Plain \
-o ColorModel=CMYK \
-o Resolution=1200dpi \
-o auth-info-required=negotiate \
-o printer-error-policy=abort-job \
-o printer-is-shared=false \
-E

 

 

/usr/sbin/lpadmin \
-p Mono_6052 \
-D "Mono" \
-L "Any MFD in school" \
-P "/Library/Printers/PPDs/Contents/Resources/Kyocera TASKalfa 6052ci.PPD" \
-v "smb://printserver.schooldomain.net/Mono" \
-o Option17=DF770 \
-o Option18=HardDisk \
-o Option19=One \
-o Option21=true \
-o Option22=true \
-o PageSize=A4 \
-o PageMediaType=Plain \
-o MediaType=Plain \
-o ColorModel=Gray \
-o Resolution=1200dpi \
-o auth-info-required=negotiate \
-o printer-error-policy=abort-job \
-o printer-is-shared=false \
-E

 

Edit. Would you be able to post the commands you are using too?

Edited September 27, 2018 by Arthur

[DalekSec]

Do you have mobility print setup? We use that on the Macs now, a lot simpler to setup!

[MicrodigitUK]

Lots of people use MacOS or Linux servers to get around this extra authentication prompt. And that will work. But Windows queues will work fine you just need them to be configured on the workstations to use Kerberos with Windows print server for each printer connection. We now have scripted this process so when a printer profile is installed by MDM or Configurator it dose the following but automatically. To test if this is your problem you can try this on one workstation:

 

Printing from Mac connected to Windows network

How to enable Kerberos authentication for shared printers

 

 

 

1. Execute the following Terminal command to enable the CUPS web interface:

 

cupsctl WebInterface=yes

 

 

 

2. Open the URL localhost:631 in Safari. Login with local admin details

 

 

 

3. Open “Printers” tab

 

 

 

4. For each printer you wish to share using Kerberos:

 

 

 

4a. Click the printer name in the list.

 

 

 

4b. Choose “Set Default Options” from the “Administration” pop-up menu.

 

 

 

4c. Click “Policies”.

 

 

 

4d. Choose “kerberos” from the “Operation Policy:” pop-up menu.

 

4e. Click “Set Default Options”.

 

 

 

5.Automatic Authenticated Printing

 

 

To enable auto authencticated printing as the logged in user to a windows printer share you will need to firstly find the name that the mac has assigned the printer this can be found by typing

 

lpstat -v

 

 

Then type in the following comman in the termial, replacing text between quotes with the desired printer as established by using the above command. Root is not required.

 

lpadmin -p "mcx_0" -o auth-info required=negotiate

 

 

Repeat this comand for each of the printers on your Mac. (Note do this in your master image Mac before tacking an image)

 

lpadmin -p "mcx_0" -o auth-info required=negotiate

 

lpadmin -p "mcx_1" -o auth-info required=negotiate

 

lpadmin -p "mcx_2" -o auth-info required=negotiate

 

 

 

 

If that fixes your problem I’ll dig out our automatic way of doing it with a script that we have packaged up for MDM deployment.

[ass17]

We send our windows printers over WiFi on macs using papercut mobility. We just advertise all the printers that the pupils are allowed to print.