About authentication and printing

Why does authentication pose a problem?

By default PaperCut NG/MF assumes the printer queues are authenticated and trusts the username that is associated with the print job. It is this user is charged for for the printing. On fully authenticated networks (like 100% Windows Active Directory networks), PaperCut NG/MF can trust the username associated with the job. There are a few common scenarios where authentication is not as simple:

1. Generic, common, or shared user accounts. (e.g. generic "student" login).

2. Systems that auto-login as a set user.

3. Unauthenticated print queues or print protocols (e.g. LPRThe Line Printer Remote protocol (LPR) is a network protocol for submitting print jobs to a remote printer. A server for the LPD/LPR protocol listens for requests on TCP port 515. A request begins with a byte containing the request code, followed by the arguments to the request, and is terminated by an ASCII LF character. An LPD printer is identified by the IP address of the server machine and the queue name on that machine. Many different queue names may exist in one LPD server, with each queue having unique settings. The LPR software is installed on the client device.).

4. Users' personal laptops that are not authenticated on the network.

Generic or shared login accounts are seen in some computer lab and network environments. In these environments administrators ask users to log in to selected systems using standard user names such as "student" or "user". This practice is particularly common on the Apple Mac operating system as a single login helps streamline system and application management. The use of the Window auto-login feature also poses a similar problem - authentication is not enforced at the time of system startup. An extra layer of authentication is required on these systems to correctly identify the person that performs printing.

Unauthenticated print queues also pose problems in cross platform environments. In an ideal world, all computers would talk the same protocols and happily work together in a single centrally authenticated environment. You can come close to this goal in a 100% Microsoft Windows environment, however, if you mix in Unix, Linux and Mac, it's a different story. Although initiatives such as CUPSCommon User Printing System (CUPS) is a printing system for Unix operating systems that allows a computer to act as a print server. A computer running CUPS is a host that can accept print jobs from client computers, process them, and send them to the appropriate printer. (Common Unix Printing System) and the Internet Printing Protocol (IPPThe Internet Printing Protocol (IPP) is an Internet protocol for communication between a print server and its clients. It allows clients to send one or more print jobs to the server and perform administration such as querying the status of a printer, obtaining the status of print jobs, or cancelling individual print jobs. IPP can run locally or over the Internet. Unlike other printing protocols, IPP also supports access control, authentication, and encryption, making it a much more capable and secure printing mechanism than older ones.) offer some hope, unification in the area of authenticated printing is still some way off. Unfortunately technical reasons often prevent networks from using CUPS authentication or exclusively using the authenticated Microsoft printing protocol.

The use of personal laptops or other unauthenticated workstations in an otherwise authenticated network is another cause of problems. These machines might not be able to authenticate to your network for a number of reasons:

• The operating system does not support authentication (like Windows Home editions).

• It is too complex to configure authentication on personal laptops.

• Users log in to their laptop with their personnally chosen username and password.

• You cannot force users to change the configuration of their personal laptops.