User Authentication and Printer Sharing with Google Cloud Print

Google Cloud Print uses Google's OAuth based system for identifying users and printers. These must be reconciled with the users and printers managed by PaperCut so that Google Cloud Print jobs can be tracked as normal PaperCut jobs and allocated to the correct PaperCut user.

This integration between Google Cloud Print and PaperCut domains is managed as follows:

  1. A Google account is set up for Google Cloud Print administration. PaperCut uses this account to publish printers and communicate with Google Cloud Print over the internet.

  2. User's Google accounts are added to the PaperCut user database as secondary email addresses. This can be done either manually or via an automated email verification process.

  3. Printers are published using PaperCut then shared with users using Google's sharing tools.

Each of these topics are covered in detail in the sections below:

Administrator Authentication

You need a Google administrator account

When Google Cloud Print is enabled in the PaperCut administrator interface, you are asked to authenticate with Google credentials. All printers will be published by PaperCut using these credentials. The use of one set of credentials to register all printers is in line with Google's best practice recommendations.

You can use any Google account for this purpose, but we recommend that you set up a dedicated account for Google Cloud Print administration. A personal account is not recommended as it may be deleted if an employee changes role or leaves your organization.

When you first enable Google Cloud Print, you will be asked to login to your Google administrator account and authorize PaperCut to have access to the Google services needed to manage Cloud Print. After accepting this request, PaperCut will permanently store an access token, avoiding the need to authenticate each time.

User Authentication

Each Google Cloud Print user must have a Google account associated with their PaperCut account.

Each Google Cloud Print user requires a Google account. This account may be self-registered, or provided to the user under a Google Apps managed environment.

PaperCut must map each user's Google account used for cloud printing to a PaperCut user. For example, Google may know a user as “[email protected]” whereas the same user in PaperCut may be “adamsj” with an email “[email protected]”.

As with this scenario, PaperCut allows multiple email addresses to be associated with a user. Each user may have one primary email address and multiple secondary email addresses. All addresses must be unique across the system.

PaperCut provides two ways to populate the secondary emails on behalf of each user. You should select which method is best for your organization:

  1. Manual configuration. An administrator may add and remove secondary email addresses on behalf of a user in the Users tab of the PaperCut Admin interface.

  2. Self registration through automatic email verification.

When a print job arrives from Google, PaperCut finds the user with a primary or secondary email address matching the address of the sender. The matching user is then associated with the incoming print job.

If no matching user is found, you may choose to have PaperCut cancel the job, or hold the job and perform automatic email verification. Cancelling the job is the appropriate response if you are choosing to manually configure the secondary email addresses.

Automatic email verification works as follows:

  1. When a job arrives from an unknown user, the job is held and an email is sent to the originating Google email address asking for the user to click a link to validate their account.

  2. The link takes the user to the login screen for the PaperCut web interface.

  3. The user logs into their PaperCut account and the Google address is automatically associated with this account.

  4. The job proceeds to print as the verified PaperCut user.

Publishing and Sharing Printers

Each printer must be published and “Shared” with end users.

Printers are published to Google Cloud Print in order to make them available for Cloud printing. By default, printers managed by PaperCut are not published to Google Cloud Print. Publishing is performed by a single button click in the Printer Details page. A printer may be published or unpublished at any time after enabling Google Cloud Print.

Printers are published by PaperCut using your chosen Google administrator account. By default only that account will have access to the printers for printing. To make printers available to your Google Cloud Print users, you must share your printers.

Printer sharing is a Google feature and is administered in Google's Cloud Print web interface (https://www.google.com/cloudprint#printers), not in PaperCut.

You may share printers with individual users by specifying a list of Google email addresses. You may also share printers with a Google Group. For example, you could set up a Google Group for Students and another group for Teachers and share printers to those groups. Users may self-register with the appropriate Google Groups, but you may need to moderate these registrations. Google provides mechanisms for people to request membership to a Google Group and for a moderator to accept or reject those requests.

Tip

When a printer is shared with a user, the user must accept the sharing “invitation” before they are able to use the printer for printing. This action is performed within Google's web interface and at the time of writing is not available on some mobile devices. We recommend you test the sharing of printers at your site and provide users with any guidance needed to ensure they are able to successfully accept printers shared with them. It may be necessary to request people use a desktop browser to accept the sharing invitation.

Client Popups and Google Cloud Print

Some print jobs require user input to select an account to charge before they can print. This task is performed using the PaperCut Web Client, accessed using the URL http://servername:9191/client.

The Web Client is especially designed to work across the wide range of mobile and desktop devices that will be used for printing with Google Cloud Print. iPhone and iPad users may already recognise the Web Client as the iPhone or iPad App described in the section called “The PaperCut iPad / iPhone App (iOS app) ”.

Users may require some prompting to remind them to use the Web Client. For Google Cloud Print jobs that require account selection, a reminder email message can be sent to the originator of the job if the account is not selected within 90 seconds of job submission. PaperCut waits 90 seconds so that experienced users may select their account and print without receiving an email.

Notes:

  1. You may use Print Scripts with Google Cloud Print jobs. However, the Web Client does not currently support script popup messages, so any scripts associated with Google Cloud Print printers must not require popups.

  2. The desktop client will not work with Google Cloud Print jobs, as these jobs typically originate away from the desktop. Use the Web Client for Google Cloud Print jobs.

  3. If you wish to skip the Web Client step, it may be necessary to create separate print queues for use with Google Cloud Print and override the Account Selection options to automatically select the account to be charged.