Sequoia 'Hold for Authentication' Workaround

[Griffin-Chaz]

We noticed that the recent MacOS Sequoia update really messed with our users ability to print. 

To cover what has been happening with us, when a user adds a printer from Self Service, the very first print job never brings up the window for them to enter their credentials. Instead just sitting on "Hold for Authentication". Hitting that little refresh button doesn't do anything, and most of the old fixes I found online don't seem to help. Once the user cancels that job, then sends it again, the pop-up happens and everything is good to go from that point on.

So, as a temporary workaround until we can find the actual issue we came up with this little script to send a 'dummy' print job, wait a few seconds to hit the authentication, then cancel the job. So far this has been working great so I wanted to post that script here just in case someone else can make use of it.

Note: Is it just me or is there no Shell/Bash option when pasting code here?

#!/bin/bash

# Get printer name from JAMF variable ($4)
PRINTER_NAME="$4"

# Set log file location
LOG_FILE="/Users/$3/Library/Logs/initial_print_auth_fix.log"

# Start logging
echo "===== Print Test Script Started: $(date) =====" | tee -a "$LOG_FILE"

# Check if a printer name was provided
if [[ -z "$PRINTER_NAME" ]]; then
    echo "Error: No printer name provided. Exiting..." | tee -a "$LOG_FILE"
    exit 1
fi

# Verify if the printer exists
if lpstat -p "$PRINTER_NAME" &>/dev/null; then
    echo "Printer found: $PRINTER_NAME" | tee -a "$LOG_FILE"
    echo "Sending test print to $PRINTER_NAME..." | tee -a "$LOG_FILE"
    
    # Send a dummy print job and log output
    lp -d "$PRINTER_NAME" enter/path/to/any/file/really/doesnt/seem/to/matter >> "$LOG_FILE" 2>&1

    # Wait for the job to enter the queue
    sleep 10

    # Get the job ID for the most recent job on this printer
    JOB_ID=$(lpstat -o "$PRINTER_NAME" | awk 'NR==1 {print $1}')

    if [[ -n "$JOB_ID" ]]; then
        echo "Canceling job $JOB_ID on $PRINTER_NAME..." | tee -a "$LOG_FILE"
        cancel "$JOB_ID" >> "$LOG_FILE" 2>&1
    else
        echo "No job found for $PRINTER_NAME." | tee -a "$LOG_FILE"
    fi
else
    echo "Error: Printer '$PRINTER_NAME' not found." | tee -a "$LOG_FILE"
    exit 1
fi

echo "===== Print Test Script Finished: $(date) =====" | tee -a "$LOG_FILE"

exit 0

[ImAMacGuy]

The hold for authentication has been around for a LOONG time.  I believe it's something to do with how the MS Print services recognize accounts/ids from a Mac.  Once resume the first print and put in your credentials then it saves it in the keychain until your next password reset and then the password needs to be updated again.  

[Griffin-Chaz]

Oh I know the Hold for Authentication has been a thing for a while. But the specific issue I'm talking about in the post only started happening on our laptops that updated to MacOS 15 Sequoia. We have no issues on any laptop that is version 14 or lower.

I was just sharing a workaround that seems to be working for us while we try to really fix it.

[tkraus]

Just ran into this the other day.... I guess I haven't tried removing the print job, but noticed the second user to sign in has no issue, and of the original user signs back in, they equally have no issue. You are correct however, that the common methods do not seem to resolve. I get a Filter Failed message along with it. I'll see if I can upload a screenshot when I get back to the office.