How to use the command line to automate user sign in for PaperCut Hive and Pocket

PaperCut Hive and Pocket allow system administrators to use scripts to automate user identity processes on macOS and Windows clients. This article explains the syntax and provides example scripts to help you link users to installed clients for printing.

When to use scripts to automatically link users for printing

You might consider automating the user identification process when onboarding users in the following scenarios:

• Unmanaged environments: Organizations such as libraries or coworking spaces where identities are managed outside of a single standard Identity Provider (IdP).
• Simplified user experience: Environments like schools where you want to remove the need for users to manually enter their identity.
• Transparent transitions: When you want to implement managed printing without user interaction.

Avoid automatic sign-in for these environments:

• Highly secure or compliant: Organizations like hospitals or law firms that require strict identity verification.
• Enforced SSO: Environments that want to establish “good habit” sign-in practices, such as when rolling out a new IdP.
• Unmanaged or BYOD: Environments where user data is inconsistent, such as BYOD universities or SOHO workplaces.

For other options, see alternatives to automatic linking below.

How to format commands to link user accounts

To link a user email, call the PaperCut Hive Print Client service using the following syntax:

macOS

/Users/[target-user]/Library/PaperCut Hive/pc-print-client-service command link-with-email [SYSTEM-KEY] [User Email] [REGION]

Windows

$env:LOCALAPPDATA\Programs\PaperCut` Hive\pc-print-client-service.exe command link-with-email [SYSTEM-KEY] [User Email] [REGION]

How to locate the system key

The system key validates the command with the cloud. To locate the system key’s value:

1. In the admin console, go to Edge Mesh.
2. Select Add edge nodes.
3. Click Manually deploy edge nodes.
4. In the Use this command to run the installer field, copy the /systemkey value between the quotation marks.

Automatic linking script examples

Linking Windows users

This PowerShell script derives an email from the first and last name of the last logged-in user.

#Outline
$sysKey = "aa12b3cccdddd444455eee666666fffffggh77778888888jjklmmmnnnnooooopppppp999999qqqqrrrrsstttttuuuvvv000000wwwwxxxyyyyzzzzz"
$domain = "example.org"
$region = "us"
$usersDir = "C:\Users\"
$localAppData = "\Programs\PaperCut Hive\"
Write-Host "Starting linking process..."
#Queries registry to find the last logged in user
$lastUser \= (Get-ItemProperty "HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI" | select LastLoggedOnUser | foreach {Write-Output $_.LastLoggedOnUser})
Write-Host "Found most recently logged in user:"
Write-Host $lastUser
#Reformats to a searchable string
$searchableUser = ($lastUser -replace '.\\', '')
Write-Host "Updating user formatting to be searchable..."
Write-Host $searchableUser
#Looks up the Full Name of the **LOCALLY CREATED** user
$fullName = (Get-LocalUser $searchableUser | select FullName | foreach  {Write-Output $_.FullName})
Write-Host "Found user full name:"
Write-Host $fullName
#Merges first and last name with a period, assuming email format is firstname.lastname
$formattedName = $fullName.ToLower() -replace '\s+', '.'
Write-Host "Enforcing lowercase"
Write-Host $formattedName
#Build it as an email
$email = $formattedName + "@" + $domain
#Run the linking command
$cmd = $usersDir + $searchableUser + $localAppData + "pc-print-client-service.exe command link-with-email " + $sysKey + " " + $email + " " + $region
& $cmd

Linking Mac users

This Zsh script derives an email from the RealName attribute of the last logged-in user.

#! /bin/zsh
#Outline required information (company email domain name, system key, and PaperCut Hive region)
sysKey="aa12b3cccdddd444455eee6666fffffggh77778888jjjjkkllmmmnnnooppp9999qqqqrrrrsstttuuuvvv00000wwwwxxxyyyzzz"
domain="example.org"
region="us"
#finds last logged in user
user=$(defaults read /Library/Preferences/com.apple.loginwindow.plist lastUserName)
echo "Found the following username: $user"
homedir="/Users/$user/Library/PaperCut Hive/"
echo "Hive should be located in: $homedir"
#looks up user's first and last name
fullName=$(dscl . -read /Users/$user RealName)
echo "The name found for this account is:"
echo $fullName
#Removes additional formatting from response - including the "RealName: \n" header. Then converts to lowercase and replaces spaces in responses with periods.
formattedName="${fullName/'RealName:'/}"
formattedName="$(echo $formattedName | tr \-d '\n')"
formattedName="${formattedName/ /}"
formattedName="${formattedName// /.}"
formattedName="${formattedName:l}"
echo "the name for the email is : $formattedName"
#converts to an email address using the provided domain.
email="$formattedName@$domain"
echo "Email is: $email"
#executes the command with the print client services to link the email address.
eval "'$homedir/pc-print-client-service' 'command' 'link-with-email' '$sysKey' '$email' '$region'"

Tips to prepare production-ready scripts

• Protect the system key: Ensure the system key is not accessible to end-users to prevent unauthorized registration.
• Deploy clients first: Ensure you have administratively deployed the print clients before running linking scripts.
• Prioritize security: Use authenticated login workflows where possible, as no-login workflows are less secure.
• Add error handling: Include error catching to ensure the script executes smoothly.

Alternatives to automatic linking

If automatic linking is not suitable for your organization, consider implementing these authentication options:

• System Tray icon: Users can click the icon and select Log in to associate their identity.
• Authenticate on print: Available for unlinked clients with an org.ident file.
• Manual SSO trigger: Use a login script to detect the user and trigger the sign-in prompt.

For more details, refer to Authenticating PaperCut Hive and Pocket .

Authenticate on print

The “Authenticate on print” workflow is available for any unlinked client that contains an org.ident file (/data/config/org.ident within the install path of the print client)

Trigger the sign-in page before printing

The PaperCut Hive and Pocket print client monitors for user web requests to the sign in endpoint at http:127.0.0.1:9265/login/v1. You can create a login script that detects the org.ident file and triggers the sign-in prompt after they log in.