[cups] Two issues: user authentication on MacOS, and printing multiple copies on MacOS and iPadOS

[Jeff Dyck]

I work for a school district, currently working to consolidate most of our Mac & iPad print infrastructure to CUPS (from Windows LPR & Papercut Mobility). This hopefully will allow me to properly support AirPrint on iPads (with finishing options which PaperCut Mobility does not support), and move to driverless printing from the Macs.

I’ve just put 3 small schools live on the new system, and running into a few little issues I’m hoping to find some help to work out.  

==============================

Some notes on my config:

I have CUPS 2.3.1 running on Ubuntu 20.0.4 server. That server is authenticating against Active Directory using SSSD & Realm, and I can confirm that my AD users generally work to authenticate to the CUPS Web UI and for submitting print jobs…

Most of my printers are IPP-Everywhere capable Xerox Altalink copiers, but also a handful of non IPP old HP Laserjets (postscript) and a couple old Xerox Phaser printers. 

I’m advertising the Bonjour queues via DNS-SD through static entries on a Bind DNS server.  The TXT record of the printers does specify the AIR=username,password option, so these are seen by Macs and iPads as Secure AirPrint printers.

I have 2 different ways of setting up printers for my users - the first is just selecting an AirPrint printer via the UI (either in System Prefs -> Printers, or via the “Nearby Printers” option in a print dialog), the second is running a script which uses the ipp2ppd tool to generate a ppd and then lpadmin to setup the printer using the generated ppd.  In the case of the script I tag on the -o authentication-info-required=username,password option.

I can provide sample dns txt records, as well as the cupsd.conf and cups-files.conf files if needed.

==============================


So my first issue has to do with user authentication from MacOS, mostly when configured via Airprint.

I’m seeing inconsistent results depending on the OS, which seems to map to the following table (you may need to view this with a fixed width font to make it readable).

Mac OS	Printer setup via script		Printer setup via UI/Airprint
———————————————————————————————————————————————————————————————————————————————————————————————————
11.x	Works					Works
10.15	Works					Works
10.14	Works					No auth dialog, job stuck waiting for authentication.
						Second time it works.
10.12	Asks for auth, doesn’t pass to server	Asks for auth, doesn’t pass to server
———————————————————————————————————————————————————————————————————————————————————————————————————

For 10.14+ using AirPrint setup, I’m randomly seeing an issue where the first attempt to print doesn’t ask for username/password, resulting in the job “waiting for authentication”. If I cancel and reprint again, it does ask for username/password and does print.  But that’s going to be tough to explain to my users.

Is there anything I can do to make that authentication happen more reliably?

For 10.12 (and I suspect earlier - we still have a few 10.10 & 10.11 machines around but I haven’t been able to test them) I’m seeing the following notes in the /var/log/cups/error_log files:

On the Client computer: [Client #] No authentication data provided 
On the Server: [Client #] Unable to encrypt connection: The TLS connection was non-properly terminated.  

I’m starting to suspect there is an issue with the version of SSL / CUPS on 10.12 that doesn’t work with newer certificates?  If so is there some way I can configure to keep 10.12 working? It does work with our PaperCut Mobility, but I don’t think that has any SSL on it.

FWIW I’ve double checked against a PaperCut Mobility queue - when I compare an IPP get-printer-capabilites between the PaperCut Mobility queue and the CUPS queue, I see a couple differences that may play a role:

CUPS			uri-authentication-supported = basic
PaperCut Mobility	uri-authentication-supported = requesting-user-name,basic

CUPS			uri-security-supported = none
PaperCut Mobility	uri-security-supported = none,tls

Are these settings at all important? And if so how would I configure CUPS to advertise them?


==============================

My second issue is printing multiple copies of a print job.

It doesn’t seem to matter what version of MacOS or iPad OS, if I try to print more than one copy, all I get is a single copy from the printer.  I’ve tried the following things, all to no avail:

- On MacOS client, AirPrint vs setup via lpadmin didn’t make a difference.
- On MacOS client tried doing lpoptions -p PRINTERNAME -o copies=999 - no difference
- On MacOS client tried running lpoptions - PRINTERNAME -o cupsManualCopies=true - no difference
- On CUPS server added the MaxCopies 999  in cupsd.conf - no difference.
- In the DNS txt record, tried removing the copies=T entry - no difference.

Any ideas on how I can let users print multiple copies of a document at the same time?


Thanks,

Jeff