Canon queue shows “Hold for Authentication” on Mac — quick fix

Joe B.

Reviewed for technical accuracy

Specialities: Windows 11/10, macOS (Sonoma/Ventura/Monterey), Printers, Networking, Office Equipment

Fix “Hold for Authentication” on Mac — Canon UFR II / Generic Plus, AirPrint IPP, Department ID & Secure Print

Technician

Hey! We’ll clear the “Hold for Authentication” status on your Canon printer in macOS. Tell me your Mac version (Sonoma / Ventura / Monterey) and the printer model (e.g., Canon imageRUNNER ADV / iR / i-SENSYS). Also—do you use Department ID & PIN, Account Track, or Secure Print? Those settings decide which fix we apply.

Customer

MacBook Pro on Sonoma. Office has a Canon imageRUNNER. Every job says Hold for Authentication. Sometimes it asks for a password again and again.

Technician

Got it. On Mac, “Hold for Authentication” means the queue can’t send valid credentials to the device. Common causes:
• Driver mismatch: printing via Generic PostScript or AirPrint (IPP Everywhere) while the device expects Canon UFR II / Generic Plus UFR II credentials.
• Missing Department ID Management / User Information in the Canon driver (no ID/PIN set).
• Old passwords saved in Keychain Access for the printer’s hostname/IP (macOS keeps reusing them).
• Protocol mismatch: queue added with SMB but the MFP requires IPP/LPD (or specific queue name like print / secure).
We’ll set the correct driver, add your Department ID / username, refresh Keychain, and re-add with the right protocol.

Customer

Where exactly do I put the Department ID and PIN on macOS?

Technician

Set Department ID / User info (Canon UFR II on Mac):
1) System Settings → Printers & Scanners → select your Canon → Options & Supplies → Options tab. Ensure the driver reads Canon UFR II / Generic Plus UFR II (not Generic/AirPrint).
2) Open Printer Utility (from the same dialog) → find User Information / Department ID Management → enter your Dept. ID and PIN; enable “Authenticate and Save” so jobs won’t be held.
3) If you use Secure Print, set your User Name and a document PIN in the Canon Preferences and pick Secure Print in the print dialog.

Customer

It still holds jobs. Could Keychain be the problem?

Technician

Refresh saved credentials (macOS Keychain):
• Open Keychain Access → search your printer’s hostname or IP (e.g., ir-adv-5550 or 10.0.0.45).
• Delete old Internet Password items tied to printing/IPP/SMB for that host.
• Print again; when prompted, enter the correct username/password or Department ID/PIN and check “Remember this”. This clears the canceled — hold for authentication loop.

Customer

Our IT told us to use IPP. How do I re-add the Canon with the right queue name?

Technician

Re-add Canon with IPP/LPD (fix authentication):
• Remove the old queue in Printers & Scanners.
• Click Add Printer → IP tab → set Protocol = IPP and Address = printer hostname/IP. For many MFPs, use Queue: /ipp/print or simply print. If your org uses a secure queue, use the provided name (e.g., secure).
• In Use, pick Canon Generic Plus UFR II or the exact model driver (avoid “Generic PostScript”).
• After adding, open Options & Supplies → Printer Utility and set User Information / Department ID again.

Customer

What if we’re on Active Directory accounts? It asks every time to log in.

Technician

AD/Network creds on macOS: if your print path is SMB, the prompt expects DOMAIN\\username or username@domain. Many Canon fleets prefer IPP with driver-level Department ID instead of SMB auth. Re-add with IPP and store the Dept. ID/PIN in Canon Utility; remove old SMB passwords from Keychain to stop repeated prompts.

Customer

We also see “Paused – Authentication required” in CUPS. Any CUPS commands to fix?

Technician

Advanced (CUPS / Terminal):
1) Enable CUPS UI: open http://localhost:631 → Administration → “Add Printer / Set Default Options”.
2) Terminal checks: lpstat -p (queues), lpq -P <queue> (held jobs).
3) If your environment uses username/password auth (not Dept. ID), set: lpadmin -p <queue> -o auth-info-required=username,password, then remove old Keychain items and print once to store creds.
4) For stubborn queues: Reset printing system (right-click in Printers & Scanners), then re-add with the Canon UFR II driver and set Department ID.

Customer

We sometimes use AirPrint. Is that okay with Canon?

Technician

AirPrint (IPP Everywhere) vs Canon Driver: AirPrint is great for basic printing but often does not expose Department ID, Secure Print, or finishing on Canon. For any Hold for Authentication issues—or when you need stapling, hole-punch, or Booklet—use the Canon UFR II / Generic Plus UFR II driver and set User Information.

Customer

What about Secure Print jobs? They vanish unless I enter a code at the panel.

Technician

Canon Secure Print (Mac): In the print dialog choose Job Processing → Secure Print, set your User Name and a Document PIN. At the device, pick Secure Print, select your job, and enter the PIN. If Secure jobs are still held for authentication, recheck Department ID/User Info in the driver and ensure the queue uses IPP/LPD with the Canon driver.

Customer

Great — my jobs are releasing normally now. Anything else to lock this in?

Technician

Summary: For Canon “Hold for Authentication” on macOS, install the Canon UFR II / Generic Plus UFR II driver, re-add via IPP with the correct queue, enter Department ID & PIN in Printer Utility → User Information, and clear stale Keychain passwords. Use Secure Print only when needed and avoid Generic/AirPrint if you require authentication features. Need help? Open the chat.

Quick answer: the accepted fix

Accepted fix for Canon “Hold for Authentication” on Mac (Sonoma/Ventura/Monterey): install/use the Canon UFR II / Generic Plus UFR II driver, re-add the printer via IPP (queue /ipp/print or your site’s queue), then in Printer Utility → User Information enter the correct Department ID & PIN / username & password. Finally, delete stale printer passwords from Keychain Access and print again to save new credentials.

FAQ

Step-by-step (macOS — basic)

1. Remove the old Canon queue in Printers & Scanners.
2. Click Add → IP → Protocol IPP; Address = printer host/IP; Queue = /ipp/print (or your site’s queue).
3. In Use, choose Canon UFR II / Generic Plus UFR II (avoid Generic/AirPrint).
4. Options & Supplies → Printer Utility → set User Information / Department ID & PIN and save.
5. Open Keychain Access, remove old passwords for the printer host, print once, and save new credentials.

Step-by-step (macOS — advanced/CUPS)

1. Enable CUPS UI: open http://localhost:631 → verify the queue status.
2. In Terminal: lpstat -p to view queues; lpq -P <queue> for held jobs.
3. If your site uses username/password auth: lpadmin -p <queue> -o auth-info-required=username,password, then delete Keychain entries and print to store creds.
4. If nothing helps: Right-click in Printers & Scanners → Reset printing system, then follow the basic steps again.

Sources

• Apple — If you can’t print on Mac
• Apple — Print on Mac (CUPS basics)
• Canon — UFR II / Generic Plus drivers & utilities
• CUPS — Documentation

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Start Chat

5 Tech Support Specialists are online right now.