How to configure cups for Std. User to print?

Have a look at the [CUPS help page about managing policies|http://127.0.0.1:631/help/policies.html]. This shows that you can modify the cupsd.conf so that all local users or a particular user can manage the creation of printer queues.

AFAIK all versions of 10.6 have required an administrative user to add/modify printers. If you were able to do this with a build prior to 10.6.4 then I can only assume that the cupsd.conf had been previously modified.

In checking the procedure today I noticed that I am unable to edit the cupsd.conf file through the web interface. In fact, I am unable to make any selection apply in the Admin page of the cups web page. In testing the 10.6.4 Seeds I reported a bug with the early builds with the web interface. Looks like they may not have rectified my reported issue and added more restrictions to this page. I need to check this further in case I have missed something but with two Mac's updated, both are displaying the same limitation...

PAHU wrote:
Have a look at the [CUPS help page about managing policies| http://127.0.0.1:631/help/policies.html ]. This shows that you can modify the cupsd.conf so that all local users or a particular user can manage the creation of printer queues.

In checking the procedure today I noticed that I am unable to edit the cupsd.conf file through the web interface. In fact, I am unable to make any selection apply in the Admin page of the cups web page.

Try http://localhost:631. I just discovered that worked for me. If it works for you, please update your bug report with that information. I also had a bug filed against this and submitted the workaround as a bug follow up.

As PAHU indicated, this is normally done through editing the cupsd.conf file. I believe you need to add @OWNER in one of more of the *Require user* lines in the appropriate policy section.

Thanks for the info Matt. Using localhost instead of the IP address works, not sure why, but happy that it does. I will update my bug submission.

At a guess, and I have to stress that it is just a guess, I would say that @Owner works for the cancellation of a print job but not for the creation of a print queue. So maybe this is the reason why it hasn't worked. Therefore I would suggest you try one of the following:

1. To allow all local users

<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Allow from @LOCAL
Order deny,allow
</Limit>


2. To allow specific users on the Mac

<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Require user usershortname
Order deny,allow
</Limit>

PAHU wrote:
At a guess, and I have to stress that it is just a guess, I would say that @Owner works for the cancellation of a print job but not for the creation of a print queue. So maybe this is the reason why it hasn't worked.

Yes, I did not think that one through too well. There is nothing "owned" by the user when adding a printer.

1. To allow all local users

<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Allow from @LOCAL
Order deny,allow
</Limit>

I tried that on my machine and it did not work in either 10.6.3 or 10.6.4. The only thing that I have found so far that will allow a standard user to add printers through Print & Fax preference pane is to add the user to the lpadmin group as outlined at _ http://support.apple.com/kb/TS2754_. I got to this solution by using Parental Controls and specified that a user was able to administer printers. The one thing I noticed that changed was that the user was added to the lpadmin group. I turned off Parental controls and manually added a Standard user to the lpadmin group and the Add and Delete functions became available in the Print & Fax pane.

The *Allow from @LOCAL* certainly seems to be the right policy statement, but it may not be integrated into the Print & Fax preference pane at this point.

Lisa, do you have a back up that you did before upgrading to 10.6.4? You could see what was in the cupsd.conf that worked before.

I'm not able to get the awk part to work with the [:space:] in the command, but that looks like a good solution.

Message was edited by: Matt Broughton

lmadden wrote:
I have the cupsd.conf file from before, and tried loading that, and it did not work.

Unfortunately (and probably fortunate for most users), the detail of the changes made in any upgrade is not granular enough to indicate why something that worked before is now failing. I do know that they have been working on tightening up security throughout the CUPS system. I am sure they will continue to do so.

The other factor to consider is whether the changes are coming from CUPS or from the Print & Fax preference pane. Ideally, the two should mirror each other. In practice, however, this is not always the case. How many iterations of OS X did we have before Print & Fax (Printer Setup Utility) looked in /usr/share/cups/model for PPDs. Similarly, the CUPS web interface never used to look to /Library/Printers/PPDs/Contents/Resources or /System/Library/Printers/PPDs/Contents/Resources for PPDs.

I did find the problem. Below is what worked for me--

<pre>dscl . -list /Users NFSHomeDirectory | awk '/\[\[:space:\]\]\/Users\//{print $1}' | while read n ; do sudo dseditgroup -o edit -a $n -t user _lpadmin ; done</pre>

I needed to use double square brackets around :space:. It is sometimes hard to get all the syntax posted properly in these forums. I hope this additional comment may help someone else in the future.