Handling Unauthenticated (non-domain) Laptops

Schools and colleges commonly allow students to use their personal laptops for printing to campus printers. They also want to allocate/charge printing from these unauthenticated users to the correct person. However if the systems haven't authenticated with the network, then user credentials are not provided with the print job (or worse, their personal laptop username is associated with the job). For example, on Windows networks, the jobs may list as guest. PaperCut NG addresses this this problem by providing alternate print authentication options. This section provides a step-by-step guide to configuring these authentication options.

Before continuing it is highly recommended to read the introduction to print authentication (see Chapter 25, Print Authentication). It introduces the important concepts required to understanding print authentication.

Option 1: Popup Authentication for Unauthenticated Laptops

Having chosen popup authentication to authenticate your laptop users, you should review the section called “Popup Authentication” for a detailed explanation of the feature.

Step 1: Decide whether to enable popup authentication on all printer queues

First decide whether to enable authentication for all queues, or only the queues accessed by unauthenticated laptop systems. For more information please read the section called “Handling partially authenticated networks”.

If you choose to only enable authentication for your unauthenticated laptops, you must configure a second set of unauthenticated print queues. These queues can point to the same physical printers as your authenticated queues.

Often the simplest way to set up these unauthenticated queues is to configure a separate print server that allows anonymous printing. You can make use of a firewall or operating system permissions to ensure that the anonymous users cannot access the "authenticated queues". On Windows networks, you may need to enable the guest account on the domain/system so users running the "Home" editions of Windows can print to these queues.

Step 2: Install/run the user client software on laptops

To use popup authentication, the client software must be installed and running on the unauthenticated laptops. You should make the client available for your users along with instructions of how to install the software on their laptops. The software can be easily installed on all common operating systems (Windows, Mac and Linux).

For more information on installing and deploying the client software see the section called “User Client Deployment”.

Step 3: Mark the printer queue as "Unauthenticated"

By default PaperCut NG trusts the usernames that are associated with the print job. When printing from unauthenticated laptops this username cannot be trusted. By flagging the printer queue as "unauthenticated", PaperCut NG will no longer trust the username and will prompt the user to authenticate.

Advanced: An alternate approch on Windows networks is to enable the unauthenticated option at the user-level on guest only rather than at the queue level.

To flag the printer as Unauthenticated:

  1. Log in as the built-in admin user.

  2. Click on the Printers section.

  3. Select the printer you wish to mark as Unauthenticated.

  4. In the Configuration section, enable the Unauthenticated printer checkbox.

  5. Press the OK button to save the changes.

  6. Repeat this process for each printer that requires popup authentication enabled.

Important

Once the printer is flagged as Unauthenticated, no print jobs will be printed until the user has authenticated using the client software. It is important that all workstations using these print queues are running the client software.

Step 4: Test the popup authentication

It is important to test the popup authentication once enabled. To do this:

  1. Start-up an unauthenticated laptop/workstation.

  2. Ensure that the user client software is installed and running.

  3. Perform a test print job to the queue on the print server you flagged as Unauthenticated.

  4. The client software should popup the authentication dialog box. The print job should not print until you successfully authenticate.

  5. Once authenticated, verify that the print job completes and the job is logged against the correct username in Printers->Print Jobs.

Option 2: Release Station Authentication for Unauthenticated Laptops

Having chosen release stations to authenticate your laptop users, you should review Chapter 10, Hold/Release Queues & Print Release Stations for a detailed explanation of the feature.

Step 1: Decide whether to enable release station authentication on all print queues

First decide whether to enable the the hold/release queue for all print queues, or only the queues accessed by unauthenticated laptop systems. For more information please read the section called “Handling partially authenticated networks”.

If you choose to only enable the hold/release queue for your unauthenticated laptops, you must configure a second set of unauthenticated print queues. These queues can point to the same physical printers as your authenticated queues.

Often the simplest way to set up these unauthenticated queues is to configure a separate print server that allows anonymous printing. You can make use of a firewall or operating system permissions to ensure that the anonymous users cannot access the "authenticated queues".

Step 2: Choose which Release Station interface to use

You can choose between the Standard/Software release station interface and the end-user web interface. The standard release station:

  • Requires a dedicated workstation nearby the printers that is configured to run the release station.

  • Requires less user education because when they walk up to fetch their print jobs it is obvious they need to use the release station to user the job.

The end-user web release station:

  • Requires no workstations configured near the printers. Users simply use a web browser to login to the end-user web interface and release their jobs.

  • Users must be provided with instructions on how to print and then login to the web release station to release their print jobs.

After choosing the release station interface, proceed to the appropriate step below.

Step 3a: Run and configure the Standard Release Station

If using the standard release station:

  1. Deploy the standard release station to workstations located nearby your printers. See the section called “Release Station Configuration” for information on deploying the release station.

  2. Run the release station in "Release Any" mode which allows users to login and see all print jobs awaiting release. When they release a job it will be charged to their user account. For more information see the section called “Release Station Modes”.

Step 3b: Enable and configure the End-user Web Release Station

If using the end-user web release station:

  1. Log in as the built-in admin user.

  2. Click on the Options section.

  3. In the User Features section, enable the Allow users to view held jobs (hold/release queues) option.

  4. Change the Users have permission to setting to Release any jobs (charge to their account).

  5. Press the Apply button to save the changes.

Step 4: Enable the Hold/Release queue for the print queues

By default, PaperCut NG allows the jobs to be printed without any interaction from the user. The hold/release queue feature will hold the print job until the user logs into a release station and releases the job. To enable the hold/release queue for a printer:

  1. Log in as the built-in admin user.

  2. Click on the Printers section.

  3. Select the printer you wish to enable the Hold/Release queue on.

  4. In the Configuration section, enable the Enable hold/release queue checkbox.

  5. Press the OK button to save the changes.

  6. Repeat this process for each printer that requires the hold/release queue enabled.

Important

Once the hold/release queue is enabled, no jobs will print until released using a release station. It is important to instruct your users how to use the release station, otherwise they will not be able to print.

Step 5: Test the release station

It is important to test the release station once enabled. To do this:

  1. Start-up an unauthenticated laptop/workstation.

  2. Perform a test print to a print queue with the hold/release queue enabled.

  3. For the standard release station, go to the print release station and login as a user. Select the job you printed and press the Print link to release the job. The job should begin to print.

  4. For the end-user web release station, login to the end-user web pages at http://yourserver:9191/user. Select the Jobs pending release link. Select the job you printed and press the [print] link to release the job. The job should begin to print.

  5. Login to the PaperCut NG admin pages and verify the print job was allocated to the correct user in the Printers->Print Jobs section.