Schools and colleges commonly allow students to use their personal laptops for printing
to campus printers. They also want to allocate/charge printing from these unauthenticated
users to the correct person. However if the systems haven't authenticated with the network, then
user credentials are not provided with the print job (or worse, their personal laptop username
is associated with the job). For example, on Windows networks, the jobs may list as guest.
PaperCut NG addresses this this problem by providing alternate print authentication options.
This section provides a step-by-step guide to configuring these authentication options.
Before continuing it is highly recommended to read the introduction to print authentication (see Chapter 26, Print Authentication). It introduces the important concepts required to understanding print authentication.
Having chosen popup authentication to authenticate your laptop users, you should review the section called “Popup Authentication” for a detailed explanation of the feature.
First decide whether to enable authentication for all queues, or only the queues accessed by unauthenticated laptop systems. For more information please read the section called “Handling partially authenticated networks”.
If you choose to only enable authentication for your unauthenticated laptops, you must configure a second set of unauthenticated print queues. These queues can point to the same physical printers as your authenticated queues.
Often the simplest way to set up these unauthenticated queues is to configure a separate
print server that allows anonymous printing. You can make use of a firewall or operating
system permissions to ensure that the anonymous users cannot access the "authenticated queues".
On Windows networks, you may need to enable the guest account on the domain/system so
users running the "Home" editions of Windows can print to these queues.
To use popup authentication, the client software must be installed and running on the unauthenticated laptops. You should make the client available for your users along with instructions of how to install the software on their laptops. The software can be easily installed on all common operating systems (Windows, Mac and Linux).
For more information on installing and deploying the client software see the section called “User Client Deployment”.
By default PaperCut NG trusts the usernames that are associated with the print job. When printing from unauthenticated laptops this username cannot be trusted. By flagging the printer queue as "unauthenticated", PaperCut NG will no longer trust the username and will prompt the user to authenticate.
Advanced: An alternate approach on Windows networks is to enable the
unauthenticated option at the user-level on guest only
rather than at the queue level.
To flag the printer as Unauthenticated:
Log in as the built-in admin user.
Click on the section.
Select the printer you wish to mark as Unauthenticated.
In the Configuration section, enable the Unauthenticated printer checkbox.
Press the button to save the changes.
Repeat this process for each printer that requires popup authentication enabled.
Once the printer is flagged as Unauthenticated, no print jobs will be printed until the user has authenticated using the client software. It is important that all workstations using these print queues are running the client software.
It is important to test the popup authentication once enabled. To do this:
Start-up an unauthenticated laptop/workstation.
Ensure that the user client software is installed and running.
Perform a test print job to the queue on the print server you flagged as Unauthenticated.
The client software should popup the authentication dialog box. The print job should not print until you successfully authenticate.
Once authenticated, verify that the print job completes and the job is logged against the correct username in Printers->Print Jobs.
Having chosen release stations to authenticate your laptop users, you should review Chapter 11, Hold/Release Queues & Print Release Stations for a detailed explanation of the feature.
First decide whether to enable the hold/release queue for all print queues, or only the queues accessed by unauthenticated laptop systems. For more information please read the section called “Handling partially authenticated networks”.
If you choose to only enable the hold/release queue for your unauthenticated laptops, you must configure a second set of unauthenticated print queues. These queues can point to the same physical printers as your authenticated queues.
Often the simplest way to set up these unauthenticated queues is to configure a separate print server that allows anonymous printing. You can make use of a firewall or operating system permissions to ensure that the anonymous users cannot access the "authenticated queues".
You can choose between the Standard/Software release station interface and the end-user web interface. The standard release station:
Requires a dedicated workstation nearby the printers that is configured to run the release station.
Requires less user education because when they walk up to fetch their print jobs it is obvious they need to use the release station to user the job.
The end-user web release station:
Requires no workstations configured near the printers. Users simply use a web browser to login to the end-user web interface and release their jobs.
Users must be provided with instructions on how to print and then login to the web release station to release their print jobs.
After choosing the release station interface, proceed to the appropriate step below.
If using the standard release station:
Deploy the standard release station to workstations located nearby your printers. See the section called “Release Station Configuration” for information on deploying the release station.
Run the release station in "Release Any" mode which allows users to login and see all print jobs awaiting release. When they release a job it will be charged to their user account. For more information see the section called “Release Station Modes”.
If using the end-user web release station:
Log in as the built-in admin user.
Click on the section.
In the section, enable the Allow users to view held jobs (hold/release queues) option.
Change the Users have permission to setting to Release any jobs (charge to their account).
Press the button to save the changes.
By default, PaperCut NG allows the jobs to be printed without any interaction from the user. The hold/release queue feature will hold the print job until the user logs into a release station and releases the job. To enable the hold/release queue for a printer:
Log in as the built-in admin user.
Click on the section.
Select the printer you wish to enable the Hold/Release queue on.
In the Configuration section, enable the Enable hold/release queue checkbox.
Press the button to save the changes.
Repeat this process for each printer that requires the hold/release queue enabled.
Once the hold/release queue is enabled, no jobs will print until released using a release station. It is important to instruct your users how to use the release station, otherwise they will not be able to print.
It is important to test the release station once enabled. To do this:
Start-up an unauthenticated laptop/workstation.
Perform a test print to a print queue with the hold/release queue enabled.
For the standard release station, go to the print release station and login as a user. Select the job you printed and press the Print link to release the job. The job should begin to print.
For the end-user web release station, login to the end-user web pages at
http://yourserver:9191/user. Select the Jobs pending release
link. Select the job you printed and press the [print] link to release the job.
The job should begin to print.
Login to the PaperCut NG admin pages and verify the print job was allocated to the correct user in the Printers->Print Jobs section.
© Copyright 1999-2014. PaperCut Software International Pty Ltd. All rights reserved.