Apple IOS 10.6 SSO printing with Active Directory

Integrating Apple desktops into a windows active directory infrastructure can be extremely hard and one of the most difficult aspects is enabling single sign on (SSO). In a windows world nearly all services are single sign on and it can be inconvenient and annoying for users to have to continually enter their password.

I came across difficulties when I started to map network printers on an IOS 10.6 machine. When the printer authentication dialog appeared, the username field was already populated, but instead of being populated with the username it was populated with the users real name. This meant on almost every occassion when the popup appeared, the user left the username field alone and just entered their password resulting in a failure to print and lots of support calls to IT. The answer lies in a very simple switch we can use in combination with the scutil tool.


1. Open a terminal


2. Type the following to elevate your privileges to root.

sudo su root

3. We need to set the hostname of the system to the FQDN (fully qualified domain name), replace blah.domain.com with your actual FQDN, for example.

scutil --set HostName blah.domain.com

4. Next get a list of the printer queue names by typing the following.

lpstat -v

The list is shown as below.

sh-3.2# lpstat -v
device for PRINTQUEUE001_LibraryStudent_Kyocera400ci: smb://PRINTQUEUE.blah.internal/LibraryStudent-Kyocera400ci
device for PRINTQUEUE_LibraryStudent_Kyocera400ci:: ///dev/null

The printer queue name in this example is PRINTQUEUE_LibraryStudent_Kyocera400ci



5. Now take the printer queue name(s) and run the following command, replacing the "PRINTQUEUE_LibraryStudent_Kyocera400ci" with your queue name. You need to repeat the process for every printer queue for which you want to enable SSO.

 

lpadmin -p PRINTQUEUE_LibraryStudent_Kyocera400ci -o auth-info-required=negotiate

It really is as easy as that, now the next time your users go to print to any of those Active Directory printer queues you have enabled SSO on, they will not even be prompted.