You are here: Installation > Advanced implementation > Print authentication > Handling unauthenticated (non-domain) laptops

Handling unauthenticated (non-domain) laptops

Schools and colleges commonly allow students to use their personal laptops for printing to campus printers. They also want to allocate/charge printing from these unauthenticated users to the correct person. However, if the systems haven't authenticated with the network, then user credentials are not provided with the print job (or worse, their personal laptop username is associated with the job). For example, on Windows networks, the jobs might list as guest. PaperCut MF addresses this this problem by providing alternate print authentication options. This section provides a step-by-step guide to configuring these authentication options.

Before continuing it is highly recommended to read the introduction to print authentication (see Print authentication). It introduces the important concepts required to understanding print authentication.

Option 1: Popup authentication for unauthenticated laptops

Having chosen popup authenticationPopup authentication involves matching the source IP address of the print job with the user confirmed to be operating from the popup client IP address. Authentication is provided by the PaperCut NG client software in the form of a popup dialog requesting a username and password. To print with popup authentication the client software must be running on the workstations or laptops. to authenticate your laptop users, you should review Popup authentication for a detailed explanation of the feature.

Step 1: Decide whether to enable popup authentication on all printer queues

First decide whether to enable authentication for all queues, or only the queues accessed by unauthenticated laptop systems. For more information, read Handling partially authenticated networks.

If you enable authentication only for your unauthenticated laptops, you must configure a second set of unauthenticated print queues. These queues can point to the same physical printers as your authenticated queues.

Often the simplest way to set up these unauthenticated queues is to configure a separate print serverA print server is a system responsible for hosting print queues and sharing printer resources to desktops. Users submit print jobs to a print server rather then directly to the printer itself. A print server can be a dedicated server but on many networks this server also performs other tasks, such as, file serving that allows anonymous printingAnonymous printing provides the ability for guest users to print anonymously using Email to Print. Anonymous email printing can be implemented in three ways: 1. Direct Print—Guests can send their job directly to the anonymous email defined for a physical printer. This is the most convenient way to provide printing access for guests or visitors. 2. Managed Release—Guest users send their job to the printer’s anonymous email address where it is held in a hold/release queue. Jobs are released by the receptionist or a trusted person in the organization. Jobs sent by different guests are identified by the guest’s email address, which is appended to the document name. 3. Guest Self-Release—Guest users send their job to the printer’s anonymous email address where it is held in a hold/release queue. Guests are provided with a common username and password to log in to the MFD and release their job. Jobs are identified by their email address appended to the document name.. You can make use of a firewall or operating system permissions to ensure that the anonymous users cannot access the "authenticated queues". On Windows networks, you might need to enable the guest account on the domain/system so users running the "Home" editions of Windows can print to these queues.

Step 2: Install/run the User Client software on laptops

To use popup authentication, the client software must be installed and running on the unauthenticated laptops. You should make the client available for your users along with instructions of how to install the software on their laptops. You can easily install the software on all common operating systems (Windows, Mac and Linux).

For more information on installing and deploying the client software see User Client deployment.

Step 3: Mark the printer queue as "Unauthenticated"

By default PaperCut MF trusts the usernames that are associated with the print job. When printing from unauthenticated laptops this username cannot be trusted. By flagging the printer queue as "unauthenticated", PaperCut MF no longer trusts the username and prompts the user to authenticate.

Advanced: An alternate approach on Windows networks is to enable the unauthenticated option at the user-level on guest only rather than at the queue level.

To flag the printer as Unauthenticated:

Click the Printers tab.
The Printer List page is displayed.
Select a printer.
The Printer Details - Summary page is displayed.
In the Configuration area, select the Unauthenticated printer check box.
Click OK.
Repeat this process for each printer that requires popup authentication enabled.

Important:

Once the printer is flagged as Unauthenticated, no print jobs are printed until the user has authenticated using the client software. It is important that all workstations using these print queues are running the client software.

Step 4: Test the popup authentication

It is important to test the popup authentication once enabled. To do this:

Start-up an unauthenticated laptop/workstation.
Ensure that the User ClientThe User Client tool is an add-on that resides on a user's desktop. It allows users to view their current account balance via a popup window, provides users with the opportunity to confirm what they are about to print, allows users to select shared accounts via a popup, if administrators have granted access to this feature, and displays system messages, such as, the "low credit" warning message or print policy popups. software is installed and running.
Perform a test print job to the queue on the print server you flagged as Unauthenticated.
The client software should popup the authentication dialog box. The print job should not print until you successfully authenticate.
Once authenticated, verify that the print job completes and the job is logged against the correct username in Printers >Print Jobs.

Option 2: Release Station authentication for unauthenticated laptops

Having chosen Release Stations to authenticate your laptop users, you should review Hold/release queues & Print Release Stations for a detailed explanation of the feature.

Step 1: Decide whether to enable Release Station authentication on all print queues

First decide whether to enable the hold/release queue for all print queues, or only the queues accessed by unauthenticated laptop systems. For more information, read Handling partially authenticated networks.

If you enable the hold/release queue only for your unauthenticated laptops, you must configure a second set of unauthenticated print queues. These queues can point to the same physical printers as your authenticated queues.

Often the simplest way to set up these unauthenticated queues is to configure a separate print server that allows anonymous printing. You can make use of a firewall or operating system permissions to ensure that the anonymous users cannot access the "authenticated queues".

Step 2: Choose which Release Station interface to use

You can choose between the Standard Release Station interface and the User web interface. The standard Release StationPrint Release Stations place a print job on hold and allow users to release it when required. Often a Release Station is a dedicated PC terminal located next to the printers, however, Release Stations can take other forms such as a web browser based interface. Some common examples where Release Stations can be used include secure printing, approved printing, and authentication. In a secure printing environment jobs are only printed when the user arrives at the print area and confirms his or her identity. This ensures the user is there to collect the job and other users can't "accidentally" collect the document. In some organizations it may be appropriate to hold jobs until they are approved by selected individuals. A good example would be a teacher approving printing on an expensive color printer. Hold/Release queues can be used as a form of authentication in an unauthenticated environment. Users must authenticate prior to releasing their jobs allowing PaperCut NG to confirm their identity.:

Requires a dedicated workstation nearby the printers that is configured to run the Release Station.
Requires less user education because when they walk up to fetch their print jobs it is obvious they need to use the Release Station to user the job.

The User web interfaceThe User web interface provide a range of services for users, including a summary of usage and balance history, a list of the shared accounts that the user can use for printing, the current costs for printing usage, ability to add balance by using a TopUp/Pre-Paid Card or an external payment system (when using the payment gateway module), transfer funds to other users, view a history of balance transactions, view a list of the user's recent printing, and view print jobs pending release (when using a Release Station). Release Station:

Requires no workstations configured near the printers. Users use a web browser to log in to the User web interface and release their jobs.
Users must be provided with instructions on how to print and then log in to the web Release Station to release their print jobs.

After choosing the Release Station interface, proceed to the appropriate step below.

Step 3a: Run and configure the Standard Release Station

If using the standard Release Station:

Deploy the standard Release Station to workstations located nearby your printers. See Configure a Release Station for information on deploying the Release Station.
Run the Release Station in "Release Any" mode, which allows users to log in and see all print jobs awaiting release. When they release a job it is charged to their user account. For more information see Release Station Modes.

Step 3b: Enable and configure the User web interface Release Station

If using the User web interface Release Station:

Click the Options tab.
The General page is displayed.
In the User Features area, select the Allow users to view held jobs (hold/release queues) check box.
In Users have permission to, select Release any jobs (charge to their account).
Click Apply.

Step 4: Enable the hold/release queue for the print queues

By default, PaperCut MF allows the jobs to be printed without any interaction from the user. The hold/release queue feature holds the print job until the user logs into a Release Station and releases the job. To enable the hold/release queue for a printer:

Click the Printers tab.
The Printer List page is displayed.
Select a printer.
The Printer Details - Summary page is displayed.
In the Configuration area, select the Enable hold/release queue check box.
Click OK.
Repeat this process for each printer that requires the hold/release queue enabled.