In large mixed Mac environments there may be the requirement to use popup authentication to provide a secure environment. For example, there may be a mix of lab systems and unauthenticated laptops. The lab systems are managed and secured via authentication against a central user directory source, while the unmanaged systems (e.g. laptops) are limited to local user authentication only and hence user identity is indeterminate. Popup authentication at the print queue level can be used to provide an added level of user verification. The downside to this is that this policy also affects the managed authenticated lab systems. This can frustrate users as they are forced to login twice: Once for system login and then once for printing (via PaperCut). This double authentication can be eliminated by leveraging the lab system's login hook.

This is an advanced topic and is targeted at experienced Mac administrators with basic command-line knowledge.

The double-authentication is eliminated by having the system login also perform the PaperCut login via the system login hook. After the administrator has confirmed that the workstation is securely authenticating via a the central directory service, they endorsed the system by copying a shared secret file onto the workstation. To perform this endorsement, follow these steps: