'Hold for Authentication' Error in Mac Print Queue

“Help! When printing from MacOS computers, sometimes we see the job stuck in the print queue with the message “Hold for Authentication.” What does this mean?”

What does “Hold for Authentication” mean?

“Hold for authentication” is an error message that is sometimes seen when printing from a macOS computer. The job will appear to be paused. It happens when the wrong username and password was entered to print.

This error can happen in some scenarios with PaperCut Mobility Print which we discuss in this article, but it’s more likely to be unrelated PaperCut. It can happen when a macOS client is submitting a server-hosted print queue or a Bonjour-enabled printer with no PaperCut involved.

Try these steps first (for users)

The problem most likely was that the wrong username or password was entered, so try these steps to get thing working again.

1. Try clicking the refresh button to enter different credentials. Instead of entering your macOS password, enter the credentials that you might use to connect to a file share or other network resource.
2. Alternatively, click Finder > Go > Applications > and open the app Keychain Access. Then delete the entry for the print queue in question. Cancel the pring job and try printing again. For more info, see Apple’s official guide: Delete a keychain in Keychain Access on Mac .
3. If neither of those things help, we recommend reaching out to your IT department for support. You might be entering the wrong username and password combo, or something else could be off. The rest of this article is intended for the IT crowd.

Confirm correct setup of the print queue connection

• As a troubleshooting step with Mac-hosted print queues, check to see whether authentication behaves any differently using the IPP protocol instead of Bonjour.
• Make sure that there aren’t any spaces or special characters in the printer name. That is to say; our recommendation is only to use alpha-numeric (numbers and letters) characters when naming your server print queues.
• If you’ve successfully verified the information above, it might be worth recreating the printer on the client machine. For more detailed information check out the relevant resource below:
  • Mac to Mac printing
  • Mac to Windows Printing - also see our Alternate methods for connecting a Windows queue to Mac (SMB vs. LPD/LPR) .

It’s no joke, ‘It just works’ doesn’t seem to apply to printing. However, one of our print enablement solutions might make your life easier. PaperCut Mobility Print can share print queues from your server and is completely free. PaperCut Print Deploy is bundled with our on-premise solutions and offers versatility when sharing printers with users. See Mobility Print / Print Deploy — what to use when to help you choose the right solution.

Try a different driver

Some customers have found that using a different driver resolves the issue in some cases. It’s worth checking the manufacturer’s website to see if there’s an updated (or alternative) driver.

Force the Mac to request authentication

If refreshing the job doesn’t bring up the credential prompt, you might be able to force the prompt to show with the following steps. However, if the lpadmin command doesn’t help, fear not- there’s a lot of KB article left. This option should only be used by administrators comfortable using the Terminal Application in macOS.

1. Make sure you have a job showing “hold for authentication”
2. Open terminal and type “lpstat -s” to list all printers on the system.
3. Find the problem printer ([printer-name]) in the list of devices. The printer name will be located after the line “device for”
   Ex: device for MyPrinter_5600_Series: usb://00000000-0000-0000-AB12-00000000
   In this case, the printer name would be MyPrinter_5600_Series
4. Type sudo lpadmin -p [printer-name] -o auth-info-required=username,password and hit return to run the command. Enter your Mac’s password to continue.
5. Send another job to the problem printer and enter credentials when prompted.

Check if you’re printing across subnets

Are the MacOS workstations on the same subnet as the MacOS print server? If not, on the print server launch the CUPS admin interface by browsing to http://localhost:631 then “administration” at the top, then on the right-hand side under the server settings, make sure to check “allow printing from the internet”. Keep in mind that it’s typical for CUPS to restart after making changes on the Administration Pages.

If you see this message when printing with Mobility Print

As is the case without Mobility Print, the most common cause of the “Hold for Authentication” error is entering the username and password incorrectly. you should first attempt to re-enter the credentials by clicking the refresh button: If the problem was due to an incorrect username or password, the job should go through with the correct credentials after reentry.

A problem authenticating the user

For PaperCut customers in particular, test the credentials in the user’s credentials by logging into the user web interface via http://[server_name]:9191/user. If that fails, it would be worth checking to ensure that their account isn’t locked out and their password isn’t expired. If this is happening to all users you may want to check to see if there’s a problem connecting to the User/Group Sync source. See Troubleshooting User/Group Sync .

Per-Job Authentication with Saved credentials

The message can also appear if the Mobility Print queue has Per-Job Authentication enabled and the user has peviously saved their credentials for printing in the Keychain. With credentials stored in the Keychain, the prompt for won’t pop up, but if opened, the print queue window shows “Hold for Authentication”. While annoying, this does prevent the more significant problem of a user accidentally saving their PaperCut credentials on a shared device.

Solutions:

1. Disable Per-Job Authentication′ ’ - this will not be practical if your users share devices and you want to prompt for credentials with each Mobility Print job
2. Delete the credentials from KeyChain Access′ ’ - Remove the credentials, cancel and retry the job to continue using Per-Job Authentication.

The username has an apostrophe

We believe this can happen when printing to a Mobility Print queue or a queue published directly from an AirPrint-enabled printer. At the time of this writing, we have yet to determine whether this lapse is due to CUPS, macOS, both, or something else entirely.

Solutions:

• Refresh and re-enter the same credentials - as a workaround, this allows the job to go through, but every print job sent will need this.
• For PaperCut customers specifically, turn on Username Aliasing to create a alternative username for the user that does not include an apostrophe. Users will have to remember to enter this secondary username for printing.

When using a mac device

When a user encounters “Hold For Authentication” error message when printing with Mobility Print on a mac device, adding domain\ to the front of the username should fix the issue. When entering your credentials, put in “domain\username” instead of “username” in the username field.

A rogue Mobility server

This only applies to PaperCut Mobility Print customers. We believe this is an extremely rare scenario, but we have heard of users blindly ignoring every prompt and warning we put in front of them to download the Mobility Print server application as well as PaperCut NG.

When this happens the Mobility Print server application on their Mac will re-broadcast any locally-installed printers to other users on the network. If they have legitimate printers installed, these may look identical to the printers published by the real Mobility Print server and confuse other users.

When another user tries to connect to one of these re-broadcasted printers and enters their credentials, then they will see the “Hold for Authentication” error on a macOS device or “Incorrect name or password on a iOS device.

If you believe you’re encountering this scenario, please let us know and cite ‘MOB-1550’.