{"id":810,"date":"2011-05-08T12:04:00","date_gmt":"2011-05-08T10:04:00","guid":{"rendered":"http:\/\/doenges.com\/blog\/2011\/05\/08\/tech-tip-soving-the-need-to-authenticate-a-print-operator-to-change-printer-settings-on-mac-os-x-10-6"},"modified":"2011-05-08T12:04:00","modified_gmt":"2011-05-08T10:04:00","slug":"tech-tip-soving-the-need-to-authenticate-a-print-operator-to-change-printer-settings-on-mac-os-x-10-6","status":"publish","type":"post","link":"https:\/\/doenges.com\/blog\/2011\/05\/08\/tech-tip-soving-the-need-to-authenticate-a-print-operator-to-change-printer-settings-on-mac-os-x-10-6","title":{"rendered":"Tech Tip: Soving the need to Authenticate a “Print Operator” to Change Printer Settings on Mac OS X 10.6"},"content":{"rendered":"

On Mac OS X 10.6 (Snow Leopard) a non-administrator user can not change all settings of the installed printers. This is really annoying when a printer error causes the print queue to go on hold: the user can not resume printing when the problem has been solved. Instead, a dialog pops up asking for the user name and password of a member of the “Print Operators<\/i>” group. Usually, that means a system administrator has to manually enter the credentials before the user can resume working.<\/p>\n

The problem is caused by the fact that only members of the group\u00a0“Print Operators<\/i>” are allowed to control the printer. Normal users (i.e. members of the group\u00a0“Staff<\/i>“) are not automatically added to the group\u00a0“Print Operators<\/i>“. This makes sense in an environment where you don’t want Joe Public messing with printer settings. It makes less sense in a lab or production environment where the staff can be trusted with the printers.<\/p>\n

Fortunately, I found a simple solution here<\/a>:<\/p>\n

In Terminal.app, type the following:<\/p>\n

dseditgroup -o edit -u ADMINUSER -p -a USER -t user _lpadmin<\/code><\/p>\n

where ADMINUSER is the user name of an administrator and USER is the user name you want controlling the printer.<\/p>\n

You will be asked for the password of ADMINUSER and then USER is added to the “_lpadmin<\/i>” group, solving the problem permanently.<\/p>\n

CAUTION<\/b>
A word of advice to the wise: I do not know if adding a user to the group\u00a0“_lpadmin<\/i>” has any side effects. The users of the machines I administer are considered trustworthy. The only reason they do not have administrative privileges is to protect the machines from unintended damage. So giving limited administrative privileges is not a problem. This may be different in your environment.<\/span>
Consider the implications carefully before making changes!<\/b><\/span><\/p>\n

Background Information<\/b>
It appears that the problems observed are not uniform: some machines always show the problem, some not at all, and some only for some users.<\/p>\n

It looks like Apple changed the defaults some time during the life-cycle of Mac OS X 10.5 (I have been unable to ascertain when exactly). Users created before the change were all members of “_lpadmin<\/i>“, users created later are not members.<\/p>\n

The best solution would be to tell CUPS (the printing system used in Mac OS X) to allow members of the group “Staff<\/i>” to control the printer. To do so, the file\u00a0\/etc\/cups\/cupsd.conf<\/i> section<\/p>\n

\u00a0 \u00a0 AuthType Default
\u00a0 \u00a0 Require user @AUTHKEY(system.print.operator) @admin @lpadmin
\u00a0 \u00a0 Order deny,allow<\/limit><\/code><\/p>\n

needs to be changed to something like<\/p>\n

\u00a0 \u00a0 AuthType Default
\u00a0 \u00a0 Require user @AUTHKEY(system.print.operator) @admin @lpadmin @staff<\/b>
\u00a0 \u00a0 Order deny,allow<\/limit><\/code><\/p>\n

I did not<\/b> try this myself. If you do, you may find cupsd.conf documentation<\/a> useful. I would appreciate a comment telling about your experiences. Good luck!<\/p>\n","protected":false},"excerpt":{"rendered":"

On Mac OS X 10.6 (Snow Leopard) a non-administrator user can not change all settings of the installed printers. This is really annoying when a printer error causes the print queue to go on hold: the user can not resume printing when the problem has been solved. Instead, a dialog pops up asking for the […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[463,464,183,188,461,465,467,462,466,192],"tags":[],"class_list":["post-810","post","type-post","status-publish","format-standard","hentry","category-10-6","category-cups","category-howto","category-mac-os-x-software","category-print-operators","category-printer","category-printing","category-snow-leopard","category-technical","category-tip"],"_links":{"self":[{"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/posts\/810","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/comments?post=810"}],"version-history":[{"count":0,"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/posts\/810\/revisions"}],"wp:attachment":[{"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/media?parent=810"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/categories?post=810"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/doenges.com\/blog\/wp-json\/wp\/v2\/tags?post=810"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}