'Hold for Authentication' Error in Mac Print Queue

KB Home   |   'Hold for Authentication' Error in Mac Print Queue

Main.HoldforAuthentication History

Hide minor edits - Show changes to output

November 12, 2018, at 07:27 PM by Aaron Pouliot - Fixed ignore printers link.
Changed line 37 from:
Usually, if you see this error, it is about the print queue's OS-level authentication instead of PaperCut. For this reason, we find it’s easiest to remove PaperCut from the equation when testing. Ignore the printer in PaperCut using the steps [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|in this article]]. Confirm printer ignoring works by sending a job to the queue from the server itself to make sure it doesn’t show up in PaperCut under Logs → Job Log.
to:
Usually, if you see this error, it is about the print queue's OS-level authentication instead of PaperCut. For this reason, we find it’s easiest to remove PaperCut from the equation when testing. Ignore the printer in PaperCut using the steps [[https://www.papercut.com/support/resources/manuals/ng-mf/applicationserver/topics/printer-add-remove-printer.html|in this article]]. Confirm printer ignoring works by sending a job to the queue from the server itself to make sure it doesn’t show up in PaperCut under Logs → Job Log.
September 07, 2018, at 09:14 PM by Alan Morris - fixed keychain spelling error
Changed line 14 from:
The message can also appear if the Mobility print queue has [[https://www.papercut.com/products/ng/mobility-print/manual/how-to-setup/step-2-configuration/configure-the-print-authentication-mode|Per-Job Authentication]] enabled and the user has previously saved their credentials for printing in the Keyhain. With credentials stored in the Keychain, the prompt for authentication won’t pop up, but if opened, the print queue window shows "Hold for authentication." While annoying, this does prevent the more significant problem of a user accidentally saving their PaperCut credentials on a shared device.
to:
The message can also appear if the Mobility print queue has [[https://www.papercut.com/products/ng/mobility-print/manual/how-to-setup/step-2-configuration/configure-the-print-authentication-mode|Per-Job Authentication]] enabled and the user has previously saved their credentials for printing in the Keychain. With credentials stored in the Keychain, the prompt for authentication won’t pop up, but if opened, the print queue window shows "Hold for authentication." While annoying, this does prevent the more significant problem of a user accidentally saving their PaperCut credentials on a shared device.
August 29, 2018, at 12:19 AM by Arturo - grammar, rogue mobility server, apostrophe in username
Changed line 3 from:
"''Help! When sending a print job from [=MacOS=] we sometimes see that the job is stuck in the print queue with the message "Hold for Authentication"... What does this mean?"''
to:
"''Help! When printing from [=macOS=] computers, sometimes we see the job stuck in the print queue with the message "Hold for Authentication. What does this mean?"''
Changed lines 6-9 from:
!!What does 'Hold for Authentication' mean?

This error message can sometimes appear when printing from a Mac, where the job status appear to be paused in the print queue window, with the message 'Hold for Authentication'.  This means that the user may not be authorized to send a print job, possibly because they have entered the wrong credentials. Below, we explain how this can happen in different scenarios and how to troubleshoot.
to:
!!What does "Hold for Authentication" mean?

Sometimes, when printing from a Mac, the job appears to pause in the print queue window with the message "Hold for Authentication." This condition means that the user may not be authorized to send a job to this print queue, possibly because they have entered the wrong credentials. Below, we explain how this can happen in different scenarios and how to troubleshoot.
Changed lines 12-17 from:
This message will appear when printing from [=MacOS=] to PaperCut Mobility Print if  the user enters the wrong username or password. Pressing the refresh button will give the user a chance to reenter their PaperCut credentials and the job should go through.

It can also happen if [[https://www
.papercut.com/products/ng/mobility-print/manual/how-to-setup/step-2-configuration/configure-the-print-authentication-mode|Per-Job Authentication]] is enabled, and the user has tried to save their credentials for printing in the [=KeyChain=]. When this happens, the prompt for authentication won't pop up and macOS printing system will 'hold for authentication'. While annoying, this does prevent the bigger problem of a user accidentally saving their PaperCut credentials on a shared device.

Disabling Per-Job authentication in Mobility Print will prevent the above scenario, but won't be practical if your users share devices and you want to prompt for credentials with each Mobility Print job. Alternatively, you open [=KeyChain=] to delete the credentials in question, then cancel the job and retry.

to:
This message can appear when printing from [=MacOS=] to print queues published with PaperCut Mobility Print if the user enters the wrong username or password. Pressing the refresh button gives the user a chance to reenter their credentials and, if the problem was due to an incorrect username or password, the job should go through with the correct credentials.

The message can also appear if the Mobility
print queue has [[https://www.papercut.com/products/ng/mobility-print/manual/how-to-setup/step-2-configuration/configure-the-print-authentication-mode|Per-Job Authentication]] enabled and the user has previously saved their credentials for printing in the Keyhain. With credentials stored in the Keychain, the prompt for authentication won’t pop up, but if opened, the print queue window shows "Hold for authentication." While annoying, this does prevent the more significant problem of a user accidentally saving their PaperCut credentials on a shared device.

Disabling Per-Job authentication in Mobility Print prevents the above scenario, but won’t be practical if your users share devices and you want to prompt for credentials with each Mobility Print job. Alternatively, you open [=Keychain=] to delete the credentials in question, then cancel the job and retry.

!!!A rogue Mobility server

The pickle in this case is that if a user has connected to a print queue from the Primary server and also somehow installed PaperCut and Mobility on their computer, then ''anyone'' in the office that sends jobs to this queue receives "Hold for Authentication" on their macOS device or incorrect name or password on their iOS device.

For example, ABC Co. has a Mobility print server that publishes printers to Alice, Bob, and Chuck. At one point, for whatever reason, Chuck installed PaperCut and Mobility on his computer and promptly forgot about it. Remember that by default Chuck’s rogue Mobility server publishes print queues with mDNS. In any case, the real ABC Co. Mobility server is finally publishing queues, and Chuck adds one of its printers, ABC-Printer. Alice and Bob connect to ABC-Printer, but they get hold for authentication because of the colliding mDNS advertisements from multiple Mobility servers. However, Alice and Bob can print to the queue as long as Chuck takes his laptop to work from home. Also, the ABC Co Mobility server publishes another queue, ABC-Printer-BW, but luckily, Chuck never prints in black and white so he didn’t connect this printer to his rogue Mobility server which means everyone can print to it successfully.

!!!An apostrophe in the username

The apostrophe shortcoming is inherent to macOS whether the user authenticates with their apostrophe-enabled username on a print queue advertised from Mobility or a print queue published directly from an AirPrint-enabled printer. At the time of this writing, we have yet to determine whether this lapse is due to CUPS, macOS, both, or something else entirely.

At any rate, a short-term workaround is to hit the print job's refresh icon to input one's credentials a second time, as, for some reason, the second authentication attempt sends the job through. Keep in mind every print job would require this workaround.

However, a longer-term workaround is to leverage PaperCut's  [[https://www.papercut.com/kb/Main/UserNameAliasing|username aliasing]] feature. Turn on username aliasing under Options > Advanced > Username Aliasing. Next, go to your apostrophe-enabled user and populate their username alias with a name that doesn't include an apostrophe. As you can imagine, leveraging username aliasing comes with the condition that users with apostrophe-enabled usernames require training to authenticate with the new alias when sending jobs to Mobility print queues.


Changed lines 35-49 from:
This message is often completely unrelated to PaperCut, but may show up when customers start implementing shared Print queues on servers.

Usually if you see this error, it is actually the OS-level authentication that’s being referenced instead of PaperCut.
For this reason, we find it's easiest to remove PaperCut from the equation when testing.  Ignore the printer in PaperCut by [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|ignoring the printer in PaperCut]].  Send a test job to the printer from the server itself to make sure that the job doesn’t show up in PaperCut under Logs -> Job Log.

Note that if you’re testing to see if it’s happening at the OS level with PaperCut excluded, you’ll still need to print through the shared print queue on the server. Printing directly from the workstation to the Printer will bypass the server print queue entirely (and also PaperCut) so will not be a true test of the server queue.

How we wish there was one ‘fix all’ solution
for this. Sadly our customers and the forums have proved that there may be different fixes depending on exactly what is causing the issue. A few suggestions to try are below...

!!!Make sure the Server Print queue is installed correctly

*If printing to a Windows hosted print queue from a Mac workstation, make sure you’re using [[https://www.papercut.com/products/ng/manual/ch-mac-printing-windows.html#mac-printing-windows-scenario-one|SMB]]. Some customers have also resolved the issue by uninstalling the print queue and then installing the printer using the ‘Windows’ tab as per [[https://support
.apple.com/kb/PH18615?locale=en_US|Apple’s documentation]].
*If printing to a Mac hosted
print queue from a Mac workstation, make sure that the printers have been added to the workstation using [[https://www.papercut.com/products/ng/manual/ch-mac-printing-10-8-9.html#ch-mac-printing-10-8-9-set-up-printers|IPP]].
*Make sure that there aren’t any spaces or special characters in the printer
name.
to:
This message is often wholly unrelated to PaperCut but may show up when customers start implementing shared print queues on servers.

Usually, if you see this error, it is about the print queue's OS-level authentication instead of PaperCut. For this reason, we find it’s easiest to remove PaperCut from the equation when testing. Ignore the printer in PaperCut using the steps [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|in this article]]. Confirm printer ignoring works by sending a job to the queue from the server itself to make sure it doesn’t show up in PaperCut under Logs → Job Log.

Keep in mind that one has to send the job to the server's shared print queue as printing directly from a workstation to the printer bypasses the server print queue entirely (and also PaperCut) so is not a real test of potential issues with the server queue.

!!!Confirm correct setup of the print queue connection

*For organizations with small numbers of macOS clients, an easy to manage connection protocol
for Windows hosted print queues is [[https://www.papercut.com/products/ng/manual/ch-mac-printing-windows.html#mac-printing-windows-scenario-one|SMB]]. If users have authentication issues with an SMB-connected print queue, make sure that they are using their current username and password. Sometimes, users are unaware that their password expired or are unaware that their SMB username changed after changing their surname with HR, payroll, or AD, for example. However, rather than training users on adding a print queue using the SMB protocol, keep in mind that they can also add Windows hosted queues with the ‘Windows’ tab as per [[https://support.apple.com/kb/PH18615?locale=en_US|Apple’s documentation]]. With SMB-connected queues, it may also be worth using the printer's fully qualified domain name as detailed in [[http://support.apple.com/en-us/HT203814|Apple's Support Article]].
*As a troubleshooting step with Mac-hosted print queues, check to see whether authentication behaves any differently using the [[https://www.papercut.com/products/ng/manual/ch-mac-printing-10-8-9.html#ch-mac-printing-10-8-9-set-up-printers|IPP]] protocol instead of Bonjour.
*Make sure that there aren’t any spaces or special characters in the printer name. That is to say; our recommendation is only to use alpha-numeric (numbers and letters) characters when naming your server print queues.

Changed line 49 from:
*First try hitting the ‘Refresh’ icon in the screenshot above (where the mouse pointer is), to see if that forces the OS level authentication again.
to:
*First try hitting the ‘Refresh’ icon in the screenshot above (where the mouse pointer is), to check whether forcing the re-request of credentials inherent to this method helps.
Changed lines 56-59 from:
!!!Try using a fully qualified domain name for the printer

*If you’re using an AD-authorized queue, then it may be worth changing the mapping to the fully qualified domain name as detailed in [[http://support.apple.com/en-us/HT203814|Apple's Support Article]].

to:
Changed line 59 from:
*Are the workstations on the same subnet as the print server? If not, on the print server if you go into the CUPS interface at @@[=http://localhost:631=]@@ then go into ‘Administration’ at the top, then on the right hand side under the Server settings, make sure that 'Allow printing from the Internet’ is checked. If that’s not checked, it will ask you to restart CUPS.
to:
*Are the macOS workstations on the same subnet as the macOS print server? If not, on the print server launch the CUPS admin interface by browsing to @@[=http://localhost:631=]@@ then "Administration" at the top, then on the right-hand side under the Server settings, make sure  to check "Allow printing from the Internet." Keep in mind that it's typical for CUPS to restart after making changes on the Administration page.
April 30, 2018, at 06:08 PM by Aaron Pouliot -
Changed line 3 from:
"''Help! When sending a print job from MacOS we sometimes see that the job is stuck in the print queue with the message "Hold for Authentication"... What does this mean?"''
to:
"''Help! When sending a print job from [=MacOS=] we sometimes see that the job is stuck in the print queue with the message "Hold for Authentication"... What does this mean?"''
April 12, 2018, at 05:25 PM by Aaron Pouliot -
Changed lines 6-13 from:
!!About the 'Hold for Authentication' message

When printing from a Mac, customers will sometimes see the job status appear to be paused in the print queue
window, with the message 'Hold for Authentication'. This can happen for a number of reasons, which we describe below.

!!If you see this job when printing with PaperCut Mobility Print

This error can appear when printing from [=MacOS=] to Mobility Print if  the user enters the wrong credentials. Pressing the refresh button will give the user a chance to enter the correct credentials.

to:
!!What does 'Hold for Authentication' mean?

This error message can sometimes appear when printing from a Mac, where the job status appear to be paused in the print queue
window, with the message 'Hold for Authentication'.  This means that the user may not be authorized to send a print job, possibly because they have entered the wrong credentials. Below, we explain how this can happen in different scenarios and how to troubleshoot.

!!If you see this message when printing with Mobility Print

This message will appear when printing from [=MacOS=] to PaperCut Mobility Print if  the user enters the wrong username or password. Pressing the refresh button will give the user a chance to reenter their PaperCut credentials and the job should go through.

Changed lines 18-21 from:
!!If you see this error without PaperCut Mobility Print

We’ve seen this error at customer sites, and we’ve also noticed online forums with a lot of activity due to this particular error. It looks to be unrelated to PaperCut, but often shows up when customers start implementing shared Print queues on servers.
to:
!!If you see this message without Mobility Print

This message is often completely unrelated to PaperCut, but may show up when customers start implementing shared Print queues on servers.
Changed line 23 from:
For this reason, we find it's easiest to remove PaperCut from the equation when testing. Ignore the printer in PaperCut by [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|ignoring the printer in PaperCut]]. Send a test job to the printer from the server itself to make sure that the job doesn’t show up in PaperCut under Logs -> Job Log.
to:
For this reason, we find it's easiest to remove PaperCut from the equation when testing.  Ignore the printer in PaperCut by [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|ignoring the printer in PaperCut]].  Send a test job to the printer from the server itself to make sure that the job doesn’t show up in PaperCut under Logs -> Job Log.
April 12, 2018, at 05:17 PM by Aaron Pouliot - removed extra screenshot
Deleted line 16:
https://www.papercut.com/kb/uploads/Main/hold_for_authentication.jpg
April 12, 2018, at 05:14 PM by Aaron Pouliot - Added information about how this error can occur with Mobility Print
Changed lines 3-10 from:
!Background

When printing from
a Mac, customers will sometimes see 'Hold for Authentication' in the job status in the print queue window. The job doesn't progress and gets 'stuck'.

We’ve seen
this error at customer sites, and we’ve also noticed online forums with a lot of activity due to this particular error. It looks to be unrelated to PaperCut, but often shows up when customers start implementing shared Print queues on servers.

Note that if you see this error, this is actually OS-level authentication that’s being referenced - not the PaperCut Client authentication.

to:
"''Help! When sending a print job from MacOS we sometimes see that the job is stuck in the print queue with the message "Hold for Authentication"... What does this mean?"''
Changed lines 5-8 from:
!Troubleshooting preparation

Given that this is normally unrelated to PaperCut, in order to keep things simple while troubleshooting, it can
be easier to remove PaperCut from the equation first. Ignore the printer in PaperCut by [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|ignoring the printer in PaperCut]]. Send a test job to the printer from the server itself to make sure that the job doesn’t show up in PaperCut under Logs -> Job Log.
to:

!!About the 'Hold for Authentication' message

When printing from a Mac, customers will sometimes see the job status appear to
be paused in the print queue window, with the message 'Hold for Authentication'. This can happen for a number of reasons, which we describe below.

!!If you see this job when printing with PaperCut Mobility Print

This error can appear when printing from [=MacOS=] to Mobility Print if  the user enters the wrong credentials. Pressing the refresh button will give the user a chance to enter the correct credentials.

It can also happen if [[https://www.papercut.com/products/ng/mobility-print/manual/how-to-setup/step-2-configuration/configure-the-print-authentication-mode|Per-Job Authentication]] is enabled, and the user has tried to save their credentials for printing in the [=KeyChain=]. When this happens, the prompt for authentication won't pop up and macOS printing system will 'hold for authentication'. While annoying, this does prevent the bigger problem of a user accidentally saving their PaperCut credentials on a shared device.

Disabling Per-Job authentication in Mobility Print will prevent the above scenario, but won't be practical if your users share devices and you want to prompt for credentials with each Mobility Print job. Alternatively, you open [=KeyChain=] to delete the credentials in question, then cancel the job and retry.
https://www.papercut.com/kb/uploads/Main/hold_for_authentication.jpg

!!If you see this error without PaperCut Mobility Print

We’ve seen this error at customer sites, and we’ve also noticed online forums with a lot of activity due to this particular error. It looks to be unrelated to PaperCut, but often shows up when customers start implementing shared Print queues on servers.

Usually if you see this error, it is actually the OS-level authentication that’s being referenced instead of PaperCut.
For this reason, we find it's easiest to remove PaperCut from the equation when testing
. Ignore the printer in PaperCut by [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|ignoring the printer in PaperCut]]. Send a test job to the printer from the server itself to make sure that the job doesn’t show up in PaperCut under Logs -> Job Log.
Changed lines 28-30 from:
!Troubleshooting steps

How
we wish there was one ‘fix all’ solution for this : ) Sadly our customers and the forums have proved that there may be different fixes depending on exactly what is causing the issue. A few suggestions to try are below...
to:
How we wish there was one ‘fix all’ solution for this. Sadly our customers and the forums have proved that there may be different fixes depending on exactly what is causing the issue. A few suggestions to try are below...
October 23, 2015, at 11:15 PM by timg - Updated pic formatting
Deleted line 11:
October 23, 2015, at 11:14 PM by timg - Introduction update
Added lines 4-5:

When printing from a Mac, customers will sometimes see 'Hold for Authentication' in the job status in the print queue window. The job doesn't progress and gets 'stuck'.
October 23, 2015, at 10:59 PM by timg - Created initial article
Added lines 1-47:
(:title 'Hold for Authentication' Error in Mac Print Queue:)

!Background

We’ve seen this error at customer sites, and we’ve also noticed online forums with a lot of activity due to this particular error. It looks to be unrelated to PaperCut, but often shows up when customers start implementing shared Print queues on servers.

Note that if you see this error, this is actually OS-level authentication that’s being referenced - not the PaperCut Client authentication.

------> Attach:hold_for_authentication.jpg

!Troubleshooting preparation

Given that this is normally unrelated to PaperCut, in order to keep things simple while troubleshooting, it can be easier to remove PaperCut from the equation first. Ignore the printer in PaperCut by [[https://www.papercut.com/products/ng/manual/ch-printer-mgmt.html#ch-printer-mgmt-add-remove-printer|ignoring the printer in PaperCut]]. Send a test job to the printer from the server itself to make sure that the job doesn’t show up in PaperCut under Logs -> Job Log.

Note that if you’re testing to see if it’s happening at the OS level with PaperCut excluded, you’ll still need to print through the shared print queue on the server. Printing directly from the workstation to the Printer will bypass the server print queue entirely (and also PaperCut) so will not be a true test of the server queue.

!Troubleshooting steps

How we wish there was one ‘fix all’ solution for this : ) Sadly our customers and the forums have proved that there may be different fixes depending on exactly what is causing the issue. A few suggestions to try are below...

!!!Make sure the Server Print queue is installed correctly

*If printing to a Windows hosted print queue from a Mac workstation, make sure you’re using [[https://www.papercut.com/products/ng/manual/ch-mac-printing-windows.html#mac-printing-windows-scenario-one|SMB]]. Some customers have also resolved the issue by uninstalling the print queue and then installing the printer using the ‘Windows’ tab as per [[https://support.apple.com/kb/PH18615?locale=en_US|Apple’s documentation]].
*If printing to a Mac hosted print queue from a Mac workstation, make sure that the printers have been added to the workstation using [[https://www.papercut.com/products/ng/manual/ch-mac-printing-10-8-9.html#ch-mac-printing-10-8-9-set-up-printers|IPP]].
*Make sure that there aren’t any spaces or special characters in the printer name.

!!!Try removing the saved authentication from the Keychain

*First try hitting the ‘Refresh’ icon in the screenshot above (where the mouse pointer is), to see if that forces the OS level authentication again.
*Open your Keychain Access.app and delete the entry for the print queue in question. Then cancel the job and retry. More info on that over on the [[https://discussions.apple.com/message/23779101|Apple forums]].

!!!Try a different driver

*Some customers have found that using a different driver resolves the issue in some cases. It’s worth checking the manufacturer's website to see if there’s an updated (or alternative) driver.

!!!Try using a fully qualified domain name for the printer

*If you’re using an AD-authorized queue, then it may be worth changing the mapping to the fully qualified domain name as detailed in [[http://support.apple.com/en-us/HT203814|Apple's Support Article]].

!!!Check if you’re printing across subnets

*Are the workstations on the same subnet as the print server? If not, on the print server if you go into the CUPS interface at @@[=http://localhost:631=]@@ then go into ‘Administration’ at the top, then on the right hand side under the Server settings, make sure that 'Allow printing from the Internet’ is checked. If that’s not checked, it will ask you to restart CUPS.

----
''Categories:'' [[Category.Mac|+]],[[Category.Troubleshooting|+]]
----
[-Keywords: hold for authentication, waiting for authentication, authenticate, mac, os x, print queue-]

Comments

Share your findings and experience with other PaperCut users. Feel free to add comments and suggestions about this Knowledge Base article. Please don't use this for support requests.

Article last modified on November 12, 2018, at 07:27 PM
Printable View   |   Article History   |   Edit Article