Note that this will apply to both ‘Kiosk mode’ on a Chromebook, and also when sharing printers with individual devices, rather than with users or user groups.
Since the release of PaperCut version 13.5, the ability to print using Google Cloud Print (GCP) has been available to make BYOD easier and more manageable. Our recommended setup process for GCP has been documented and is made available here.
For school administrators using Chromebooks, it has generally been easier to share local printers out with the Chromebook instead of singular users. This allows your users to print whether they are logged into their GCP account or not. The high-level explanation behind this is that the Chromebook itself is given an account to use for GCP enabled printers rather than relying on users to log into Google for printing functionality.
PaperCut support has seen a few instances where administrators have been using this method and seeing jobs denied from an email that ends with @chrome-enterprise-devices.gserviceaccount.com
What is this email suffix?
If a printer has been shared using this type of functionality, any user on the device can print to the printer regardless of what user may be logged into Google. In this case, GCP and PaperCut both do not know who is actually behind the keyboard at that point in time - just that a person has printed on an authorized Chromebook.
This will not be able to be used within PaperCut, as there is no user to account for the job, and there is no mailbox linked to this alias, which means PaperCut cannot send any authorization requests to that address.
PaperCut’s recommendation for this type of deployment would be to share out the printers specifically to Google user accounts - or Google Groups, if utilized. Doing this means that the users email address will be printing to the GCP enabled printer rather than the Chromebook. This allows Google and GCP to successfully bind a user to that print job, and allows us to successfully look the email up in PaperCut to find that user.
A workaround with Username Aliasing
It might be helpful to “trick” PaperCut into thinking the Chromebook service accounts are system users. To accomplish this ruse, use the Username Aliasing feature’s text file option.
To get the names, you can check the job log as above to find documents that didn’t print due to the unknown email/user policy. Another method is to send a job to a paused print queue with on-demand user creation enabled. The new user will show up in the user list. In either case, your new addition to the username-aliases.txt file should look like this:
Once you have all of the new names, save the file. Next, return to the PaperCut user list and DELETE the users created with on-demand user creation so the next time someone sends a job from the Chromebook, it will use the alias.