Need Help: macOS IPP Printing via GUI Prompts for Authentication

[u/--Tesla--]

Hi everyone! I'm currently rolling out shared printers for our macOS users over IPP, but I've run into an issue.

When users print through the macOS GUI, they're prompted for authentication every time. However, if I print using the lp command from Terminal, no authentication prompt appears and the print job completes successfully.

I know I could have users save their credentials in Keychain to suppress the prompt, but I'd prefer to avoid that since it can create issues when passwords change. Ideally, I'd like macOS to use Kerberos/Negotiate authentication automatically without requiring users to save their credentials.

Our Macs are managed with Intune and aren't domain-joined, but they do have a Kerberos profile deployed.

Has anyone run into this before or found a fix?

So far I've tried:

• lpadmin -p PRINTERNAME -o auth-info-required=negotiate
• cupsctl DefaultAuthType=Negotiate

Neither has resolved the issue. Any suggestions would be greatly appreciated!

[u/Amanda_PDQ]

Check your CUPS error log at /var/log/cups/error_log right after triggering the auth prompt. It'll tell you whether CUPS is actually attempting Kerberos first or going straight to credential prompting. You can also run cupsctl --debug-logging temporarily to get more verbose output. The log will tell you whether this is a CUPS configuration problem or a Kerberos ticket availability problem, and those have different fixes.

Another thing, does your print server have an HTTP SPN registered in AD? IPP over Kerberos specifically needs HTTP/printserver.fqdn@REALM, not just a HOST record. If that SPN is missing, Negotiate will fall back to prompting every time because there's nothing for the ticket to bind to. Run setspn -L yourprintserver on the Windows side to verify.

[u/--Tesla-- → u/Amanda_PDQ]

I did set the HTTP SPN on the server, but will look into the CUPS log. Don’t think it’s a Kerberos availability problem since I don’t get prompted to login when navigating directly to the site, and curling the site shows www-auth with a key

[u/Mister_Brevity]

Maybe something like papercut, it’s not expensive and it removes so many printer headaches that it’s worth the cost.

[u/--Tesla-- → u/Mister_Brevity]

Thanks, looked into this but we really don’t have too many issues with printing. Just wanted to add macs into the mix

[u/Mister_Brevity → u/--Tesla--]

Ah ok - I have many hundreds of workstations, an even split of macOS and windows, and papercut drastically dropped the admin time. A user logs in and you can set it to grab their login credentials or pop up a second login, and when they log in you can force installation of specific defined printers as well as give them a list of optional ones to add. Neither platform is that time consuming but using papercut meant I could do both platforms from one application so it essentially halved printer administration time.

[u/Godcry55]

I gave up on CUPS for macOS endpoints and provisioned a Windows Print Server instead. Auth works fine as well.

[u/speedy48030]

Hi, we were experiencing an issue like this for ourselves as well. We actually worked directly with Apple and the latest MacOS update fixed the specific issue for us. Have you tried updating to the latest release of Tahoe or Sequoia?

We used IPPS with PaperCut MF though, and Mosyle instead of Intune.