This is what I use thanks to Beau Hunter.
#!/bin/bash
############################
##
## Script which polls for configured SMB printers.
## For each smb printer found, we will change the authentication
## type to "negotiate" to facilitate SSO/Kerb authentication.
##
## Written by Beau Hunter
##
########################################################
declare -x BUILD=2011022409
export PATH="/usr/bin:/bin:/usr/sbin:/sbin"
## our vars
declare -x MYNAME="configureCUPSKerb.sh"
declare -x LOGGERTAGS="-s -t "${MYNAME}""
## Executable vars
declare -x awk="/usr/bin/awk"
declare -x grep="/usr/bin/grep"
declare -x logger="/usr/bin/logger"
declare -x lpadmin="/usr/sbin/lpadmin"
declare -x lpstat="/usr/bin/lpstat"
declare -x mkdir="/bin/mkdir"
declare -x perl="/usr/bin/perl"
## Setup our logging
"$mkdir" /var/log/deployment &> /dev/null
exec >> /var/log/deployment/configureCUPSKerb.log
exec 2>&1
"$logger" $LOGGERTAGS "Started on $(/bin/date). Build: $BUILD"
## Get a list of our SMB printers
declare -x SMBPRINTERS="$("$lpstat" -v | "$grep" smb | "$perl" -p -e 's/device for (.*): smb.*/$1/g')"
OLDIFS="$IFS"
IFS=$'
'
for SMBPRINTER in $SMBPRINTERS; do
echo "Configuring printer: $SMBPRINTER for use with Kerberos authentication!"
"$lpadmin" -p "$SMBPRINTER" -o auth-info-required=negotiate
done
Script goes in /usr/local/bin
Launch Agent settings:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>Label</key>
<string>com.318.cupswatcher</string>
<key>WatchPaths</key>
<array>
<string>/etc/cups/ppd/</string>
</array>
<key>ProgramArguments</key>
<array>
<string>/usr/local/bin/configureCUPSKerb.sh</string>
</array>
</dict>
</plist>
