Macintosh Printing

The Macintosh OS is engineered to operate in a variety of printing environments. Apple provides an extensive collection of printer drivers to facilitate printing.

OS X printing is based upon CUPS (Common UNIX Printing System), the standard printing facility for Unix systems in general, and the one which Apple adopted for OS X. (Apple started developing a printing facility from scratch in 2001, but dropped that to adopt CUPS, which has been in OS X since 10.2.) Indeed, in 2007 Apple acquired the source code and its originator, Michael Sweet.

General topics

How to define a printer

Printers are defined in an OS X dialog. Go into System Preferences > Printers & Scanners (previously Print & Scan) to there click on '+' to begin defining the printer.

Where printer definitions end up

When a printer is defined, its full definition is within CUPS, specifically in the /etc/cups/printers.conf file. The printer name you specified at the OS X level has to be "normalized" for CUPS: specifically, blank and hyphen characters will be changed to underscore (_) chars. You can see what the Mac level printer names are by going into System Preferences > Print & Scan, or by launching the System Information utility to there click on Printers. To see the corresponding names of the printers within CUPS, you can go into the Terminal utility and enter the command: lpstat -s or lpc status | grep :

About duplex printing

Many printers support double-sided printing, also known as duplex printing. When you define a printer a Duplex Printing Unit checkbox will appear. If you check it, at printing time the dialog will have a Two-Sided checkbox. Selecting Two-Sided at print time causes the PostScript driver to generate duplex statements into the PostScript, to cause duplex printing on printers which need that definition. (This duplex spec within the PostScript is needed where that PostScript will be sent to the printer.)

Checking the Two-Sided box each time is a nuisance: is there a way to have that checkbox permanently checked? Yes, via the following technique...
Browse to http://localhost:631/printers
Click on your duplex printer;
Administration > Set Default Options
2-sided printing: Long Edge (Portrait)
Click: Set Default Options
And that's it: you will find the checkbox already filled in thereafter.

Printing to or through a Windows server

Setting up the printer

Perhaps the dominant method of printing to a Windows server is via the SMB protocol. This can be achieved by going into System Preferences > Print & Scan to there click on '+' to begin defining the printer. Click on the Advanced icon to get started. This will do some searching, then present a form to fill in, as follows:
Type: Windows printer via spoolss
URL: smb://<Windows server network address>/<Print queue name>
Name: __Some_name_that_makes_sense_to_you__
Location: __Where_you_know_the_printer_to_be__
Print Using: Generic PostScript Printer
Click Add.
An interjection dialog will appear. If the printer supports double-sided printing, click in the Duplex Printing Unit checkbox there. Click OK.
The printer is now defined, and can be chosen in a print dialog. Where the Windows print server requires authenticated access, you will obviously have to provide your username and password. You obviously didn't enter that information into the printer definition (and shouldn't), so where do you enter it? At print time, in your first use of this printer you should see the queue display for the printer pop up. (If not, double-click on its icon in Print & Scan.) Clicking on Resume (or the circular arrow) should bring up an authentication dialog, whereupon you can enter the username and password, which you would then want to save in the Keychain, so as to not have to go through this interaction again for future printing.

Understanding the Keychain's participation in printing

The Keychain is the historic password and general authentication keys management facility on the Macintosh. As seen above, when printing through a Windows print server which requires authentication, a username and password are to be provided, which are best stored in the Keychain. (They will be stored as Kind "network password".) You may expect that there will be a need for one Keychain password entry for each such printer — and then be surprised to see your first print to an additional printer go through with no authentication dialog. How can that be? Well, the Name for the Keychain item is just an indicative name which allows you to manage Keychain entries. The key information is embodied in the following three elements:

Account	The username or other string identity.
Where	The network identity of the server to connect to.
Password	The password to be used.

The printing operation will cause a Keychain search for an account name and network address matching the one involved in the printing operation, and thus can and will use the first matching one, regardless of the Keychain item's Name. This also means that you can have multiple keychain items with the same name, because their key internal details are different.

When there are authentication problems, as when your password as known to the remote server has changed, there is the impulse to delete the associated Keychain items, and start fresh with a new one. However, you can update an existing Keychain item... Begin by double-clicking to open it. Click in the Show password checkbox to expose the password and thus allow it to be changed. Make changes as appropriate, then click Save Changes. That's it.

Keychain health

It's healthy to clear junk out of the Keychain every once in a while. Get rid of expired certificates, and ancient password entries that you know are no longer relevant.

In addition, you can have OS X assess the Keychain via the Keychain Access utility, as follows:
Keychain Access > Keychain First Aid
Enter your user name and password
Select Verify and click Start
(Any problems found will be displayed.)

If there are problems, select Repair, and then click Start. Reboot thereafter, for thoroughness.
There are Keychain First Aid settings (Keychain Access > Preferences > First Aid) but in most cases the standard values are fine.

Dealing with problems

Print button pulsates/flashes; no response when clicked

The print button pulsates to indicate that it is the action that will be taken if the Return/Enter key is pressed. Once pressed, the print dialog should disappear and the job should proceed to print. In this problem, the button is clicked, but nothing happens. (This, in feeding a Windows 2008 print server, requiring authentication.)

So, what's wrong?
In OS 10.6, when a printer is defined via the usual OS X System Preferences GUI (Advanced tab, "Windows"), it ends up with a CUPS option of auth-info-required=none (seen via command lpoptions -p). Going to print in 10.6 in the same Windows authentication environment, one clicks the Print button and the interaction then proceeds, the job going into the print queue; thereafter one has to Resume the job in that queue to get a pop-up authentication dialog, where one would enter "Domain/Username" and Password (and save in Keychain). CUPS then dynamically changes the printer option to be auth-info-required=username,password upon realizing that reality.
In OS 10.7+, when a printer is defined the same way, it ends up with the option auth-info-required=negotiate, which is for Kerberos — which is appropriate for going through a Windows print server in a university enviroment (but otherwise may not be appropriate). CUPS may eventually get by this and finally put the job into the print queue and allow authentication to proceed, where one would enter "Username" (do *not* include Domain, in 10.7) and Password (and save in Keychain). (CUPS then sets the printer option to auth-info-required=username,password). Sometimes it remains stuck. This can usually be fixed by going into the Terminal utility and there enter the command to operate on the CUPS printer name:
sudo lpadmin -p <PrinterName> -o auth-info-required=username,password
This will update the printer stanza in /etc/cups/printers.conf, and then the printing works.

Error message "Hold for Authentication"

On Macintosh, OS Mountain Lion, appears in a printer's job progress display, where the job doesn't flow. Is likely due to stale, stored credentials: Go into the Keychain Access utility and delete the password entry for at least that printer. Refer to the keychain notes, above, and look for other site-related password entries of Kind "network password", to delete all of them, as any of them may be interfering, having an old password stored in them. (You can click on the Kind column header to sort by kind, to make finding the Network ones easier.) Then go through authentication afresh, remembering the correct password in the Keychain. The job should now print.

If there had been a hung print job when this error message was encountered, and clicking Resume on the job won't get it to move, and clicking 'X' won't remove it, you can do the following to get rid of it: Go into System Preferences > Printers & Scanners, and there click on "Options & Supplies". From that, copy the Device Name string (which is the internal name of the printer). Launch the Terminal utility to gain command line access. Enter the command: lpq -P PrinterName
where the printer name is the device name string you found above. This shows you the jobs queued on that destination, within your Mac. Get rid of the problem job via command: lprm -P PrinterName JobNumber
where the job number is what lpq reported under "Job". You can now cleanly submit a print job as usual in your Mac work.

Notes

OS X Mavericks (OS 10.9) begins Apple's use of SMB2 as its default file sharing protocol, with Apple Filing Protocol still available, but secondary. This will make Macs better performers in the enterprise. This displaces the SMBX stand-in. As such, expect printing with Windows print servers to be more robust.

Back to the Things Apple page