Enterprise Printing With Mac OS X

Enterprise Printingwith Mac OS XTechnical White PaperJanuary 2010

Technical White PaperEnterprise Printing with Mac OS XContentsPage 3OverviewAn Introduction to Printing in Mac OS XPage 5The CUPS Printing System: Under the HoodCUPS in the Context of SMB Print QueuesWhere to Find CUPS-Related FilesInstalling CUPS DriversSMB Print Queue SetupManaging Print JobsAuthenticationTroubleshootingPage 14ConclusionAdditional Resources2

Technical White PaperEnterprise Printing with Mac OS X3OverviewIn today’s heterogeneous enterprise computing environments, it’s important for differingcomputer platforms to share network resources such as printers. Due to a lack of industrystandards, enabling a variety of computer platforms to reliably share printers has beencomplicated. Mac systems can share printing resources with Windows systems withrelative ease, making it much easier for system administrators to ensure that printerscan be accessed by multiple platforms. This white paper explains how printing worksin Mac OS X and outlines how system administrators can set up Mac systems to printwithin SMB-based Windows printing environments.An Introduction to Printing in Mac OS XIn most enterprise environments, printing is based on Windows print queues thatoperate using the Server Message Block (SMB) network file-sharing protocol. WithSMB-based print queues, print jobs are typically saved to a Windows file share andauthenticated through Active Directory. This ensures that the user requesting the printjob has the appropriate credentials and permissions before the job is sent to a printerfor output.Mac OS X prints using its built-in printing system, Common UNIX Printing System (CUPS).CUPS is an advanced, standards-based, open source printing system developed byApple for Mac OS X and other UNIX-based operating systems. CUPS supports tens ofthousands of printing protocols, including proprietary queues from specific vendors,Internet printing protocol (IPP), UNIX line printer (LP) protocol, and others—making itan ideal fit for heterogeneous computing environments. With CUPS in Mac OS X, eachMac client system has the equivalent of a full-featured print server. This provides awealth of power, including the ability for any client to automatically discover printerdrivers, alleviating additional steps for both users and administrators. CUPS fullysupports Internet printing, which allows printing in locations across the Internet.CUPS also provides full control and security—a prerequisite for printing in enterpriseenvironments.Although the setup for printing in Mac OS X differs from the setup for Windows printing,integrating Mac systems into Active Directory–authenticated, SMB-based print queuesis easy. Without changing existing back-end systems, Mac OS X can discover printersadvertised in Active Directory, can print to legacy SMB print queues using credentialsfrom Active Directory, and lets administrators configure end-user systems and manageprint jobs.CUPS also provides a high level of control and security. Administrators can use centralized policy to manage printing from Mac systems, including automatically setting upprinters, determining who can print to each printer, and ascertaining whether users areauthorized to print to unmanaged printers such as local laser printers.

Technical White PaperEnterprise Printing with Mac OS X4In addition to providing robust printing controls, Mac OS X reduces IT effort by supporting numerous printers out of the box and delivering a consistent interface to make it easyfor users to select a printer. Mac OS X and CUPS also reduce hands-on IT administrativetime by automatically setting up printers for Mac users.Apple’s newest operating system, Mac OS X v10.6 Snow Leopard, allows enterpriseMac users to leverage their Kerberos login. CUPS in Snow Leopard prints to SMB printqueues by leveraging each user’s Kerberos credentials. Kerberos is the computer networkauthentication protocol that allows nodes communicating over a nonsecure networkto securely prove their identity to one another. This allows users to print to ActiveDirectory–authenticated print queues without entering credentials multiple times.Printing to Windows print queues in Mac OS X v10.5 Leopard compared withMac OS X v10.6 Snow LeopardLeopardSnow LeopardFaxing via multifunction printers requiresadditional software.Faxing via multifunction printers is integrated intothe Print dialog.Leopard includes preinstalled support forDuring installation, Snow Leopard installs supportmany printers. for configured and nearby printers. Other drivers aredownloaded automatically from Apple as new printersare discovered.

Technical White PaperEnterprise Printing with Mac OS X5The CUPS Printing System:Under the HoodWhile software applications can output to many formats for printing, the majority ofMac OS X applications output print jobs in Portable Document Format (PDF). PDF isadvantageous because Mac OS X uses PDF for onscreen display as well as when printing.Most printers are based on either the printing and imaging standard PostScript or avendor-specific raster format. PDF evolved from PostScript, so the conversion from PDFto PostScript is straightforward.CUPS uses PostScript Printer Description (PPD) files to determine the options that aresupported by each specific printer, whether or not the printer is PostScript based. Whena user attempts to print from an application running on a Mac, a standard printing dialogappears. The options defined by CUPS—number of copies, black or color, paper size,and so on—are presented to the user. Once the user selects the desired options, thePDF is saved to a file and the options and a path to the PDF file are sent to a CUPS filter.CUPS filters change the format of the print job from the initial format—PDF or other—to a file format that can be sent through a Windows print queue and then outputsuccessfully. This can involve multiple conversions through multiple filters, but sincemost Mac OS X applications output PDF files when printing, typically very few filtersare required (see graphic on the following page).When a print job is first spooled to the CUPS systems, the PPD file specifies the formatrequired by the printer. The two most common filter “chains” are PDF to PostScript, andPDF to CUPS-raster to vendor-specific format. PostScript print jobs usually contain anadditional PostScript-to-PostScript filter for page accounting and for adding vendorspecific information. The final filter is often referred to as the printer driver: It specifiesthe final format that’s required by the printer. After the print job has been convertedto the correct format, the job is sent to the printer for output.CUPS in the Context of SMB Print QueuesIn most enterprise environments, CUPS must be configured to work in the contextof SMB print queues. When CUPS prints locally, it prints directly to the designatedprinter, without sending the file to an intermediate file share. When printing to anSMB print queue, CUPS must first configure files appropriately before sending themto an SMB file share on a Windows-based print server for output (defined by the URLsmb://winserver:139, where winserver is the name of the SMB print server and port 139is the standard port for Windows print sharing). With CUPS, print jobs initiated by Macusers are saved to the SMB file share using a CUPS back end, such as SMB, USB, IPP, andFireWire. CUPS back ends are used to communicate directly to the printer.

Technical White PaperEnterprise Printing with Mac OS X6CUPS SMB PrintingThe following graphic illustrates how CUPS works within SMB print queues.CUPS SMB PrintingWhere to Find CUPS-Related FilesAs discussed previously, CUPS uses PPD files to determine both the printer options aswell as the final format required for a print job to be sent to a Windows print queue.Mac OS X includes many PPD files to support many different printers. Mac OS X PPDfiles are stored in three locations: Apple LaserWriter PPD files are located

Apple’s newest operating system, Mac OS X v10.6 Snow Leopard, allows enterprise Mac users to leverage their Kerberos login. CUPS in Snow Leopard prints to SMB print queues by leveraging each user’s Kerberos credentials. Kerberos is the computer network authentication protocol