[olePigeon]

We've started a 1:1 Laptop pilot program at work, but I've run into a problem. Students taking their laptops home can't add network printers, only USB. They also can't add the printers at school, not without needing an administrator password.

I found a way to do it, but I wanted to know if anyone can think of a reason not to do it.

I edited the "authentication" file in /etc and changed the System Preferences group from "admin" to "everyone." This leaves the printers control panel unlocked, and a standard user can add a printer. They still need admin password to modify Accounts, but that was the only one I was really worried about.

Seems to work fine, but I just wanted to get other peoples' opinions.

Thanks

[Art Vandelay]

I wouldn't do that method since you unlock more than just the printers prefpane. A better way to do it is to modify /etc/cups/cupsd.conf. Add the staff group to the items you want them to be able to do themselves.

[olePigeon]

I'm not up to snuff on modifying the cupsd.conf Can you give me an example of how it should look?

[Art Vandelay]

Sure... This is the section relevant to adding printers. Add "@staff", shown in bold, to the required user list. This allows anyone in the staff user group, which all normal users are a part of, to add a printer and also delete too. I also highly recommend modifying the access to pausing and resuming printers especially when dealing with network printers.

Code:
  <Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default>
    AuthType Default
    Require user @SYSTEM @staff
    Order deny,allow
  </Limit>

[Person Man]

Originally Posted by olePigeon 

I'm not up to snuff on modifying the cupsd.conf Can you give me an example of how it should look?

You know, that almost sounds like it would require the user to use the CUPS configuration page, instead of OS X's GUI tools. The CUPS configuration page is not the most user friendly thing. But, I could be wrong, so others may feel free to correct me.

[Art Vandelay]

No, this also governs the permissions for Apple's GUI printing tools.

[olePigeon]

Awesome, thanks. The other way I found was to comment out both authentication part and the groups part. I think I like your way better because it still requires authentication, though they don't have to be an administrator.