Configuring Labeled Printing (Task Map)

The following task map describes common configuration procedures that are related to labeled printing.

Note - Printer clients can only print jobs within the label range of the Trusted Extensions print server.

Task	Description	For Instructions
Start the Print Manager.	Uses a GUI to identify the printer to the network or to the local system. The system administrator starts the GUI in an administrative role workspace.	Chapter 4, Setting Up Printers (Tasks), in System Administration Guide: Solaris Printing
Configure printing from the global zone.	Creates a multilevel print server in the global zone.	How to Configure a Multilevel Print Server and Its Printers
Configure printing from a labeled zone.	Creates a single–label print server for a labeled zone.	How to Configure a Zone for Single-Label Printing
Configure a multilevel print client.	Connects a Trusted Extensions host to a printer.	How to Enable a Trusted Extensions Client to Access a Printer
Restrict the label range of a printer.	Limits a Trusted Extensions printer to a narrow label range.	How to Configure a Restricted Label Range for a Printer

How to Configure a Multilevel Print Server and Its Printers

Printers that are managed by a Trusted Extensions print server print labels on body pages, banner pages, and trailer pages. Such printers can print jobs within the label range of the print server. Any Trusted Extensions host that can reach the print server can use the printers that are connected to that server.

Before You Begin

Determine the print server for your Trusted Extensions network. You must be in the System Administrator role in the global zone on this print server.

Start the Solaris Management Console.
For details, see How to Administer the Local System With the Solaris Management Console.
Choose the Files toolbox.
The title of the toolbox includes Scope=Files, Policy=TSOL.
Enable multilevel printing by configuring the global zone with the print server port, 515/tcp.
Create a multilevel port (MLP) for the print server by adding the port to the global zone.
1. Navigate to the Trusted Network Zones tool.
2. In the Multilevel Ports for Zone's IP Addresses, add 515/tcp.
3. Click OK.
Define the characteristics of the connected printers.
1. Start the Print Manager.
2. Define the make and model of a connected printer.
  In the Print Manager, you supply the values for the first two fields, then the Print Manager supplies the driver name.
```
Printer Make   manufacturer
Printer Model  manufacturer-part-number
Printer Driver automatically filled in
```
Assign a printer model script to each printer that is connected to the print server.
The model script activates the banner and trailer pages for the specified printer.
For your choice of scripts, see Printer Model Scripts. If the driver name for the printer starts with Foomatic, then specify one of the foomatic model scripts. Use the following command:
```
$ lpadmin -p printer -m model
```
If the default printer label range of ADMIN_LOW to ADMIN_HIGH is acceptable for every printer, then your label configuration is done.

How to Configure a Zone for Single-Label Printing

Before You Begin

The zone must not be sharing an IP address with the global zone. You must be in the System Administrator role in the global zone.

Add a workspace.
For details, see How to Add a Workspace at a Particular Label in Solaris Trusted Extensions User’s Guide.
Change the label of the new workspace to the label of the zone that will be the print server for that label.
For details, see How to Change the Label of a Workspace in Solaris Trusted Extensions User’s Guide.
Define the characteristics of the connected printers.
1. At the label of zone, start the Print Manager.
  By default, the “Use PPD” checkbox is selected. The system finds the appropriate driver for the printer.
2. (Optional) To specify a different printer driver, do the following:
  1. Remove the check from “Use PPD”.
  2. Define the make and model of the printer that uses a different driver.
    In the Print Manager, you supply the values for the first two fields, then the Print Manager supplies the driver name.
```
Printer Make   manufacturer
Printer Model  manufacturer-part-number
Printer Driver automatically filled in
```
Assign a printer model script to each printer that is connected to the zone.
The model script activates the banner and trailer pages for the specified printer.
For your choices of scripts, see Printer Model Scripts. If the driver name for the printer starts with Foomatic, then specify one of the foomatic model scripts. Use the following command:
```
$ lpadmin -p printer -m model
```
The attached printers can print jobs only at the label of the zone.

How to Enable a Trusted Extensions Client to Access a Printer

Initially, only the zone in which a print server was configured can print to the printers of that print server. The system administrator must explicitly add access to those printers for other zones and systems. The possibilities are as follows:

For a global zone, add access to the printers that are connected to a global zone on a different system.
For a labeled zone, add access to the printers that are connected to the global zone of its system.
For a labeled zone, add access to a printer that a remote zone at the same label is configured for.
For a labeled zone, add access to the printers that are connected to a global zone on a different system.

Before You Begin

A print server has been configured with a label range or a single label, and the printers that are connected to it have been configured. For details, see the following:

How to Configure a Multilevel Print Server and Its Printers
How to Configure a Zone for Single-Label Printing
How to Assign a Label to an Unlabeled Print Server

You must be in the System Administrator role in the global zone, or be able to assume the role.

Complete the procedures that enable your systems to access a printer.
To use the Print Manager instead of the lpadmin command, see Example 21-1.
- Configure the global zone on a system that is not a print server to use another system's global zone for printer access.
  1. On the system that does not have printer access, assume the System Administrator role.
  2. Add access to the printer that is connected to the Trusted Extensions print server.
```
$ lpadmin -s printer
```
- Configure a labeled zone to use its global zone for printer access.
  1. Change the label of the role workspace to the label of the labeled zone.
    For details, see How to Change the Label of a Workspace in Solaris Trusted Extensions User’s Guide.
  2. Add access to the printer.
```
$ lpadmin -s printer
```
- Configure a labeled zone to use another system's labeled zone for printer access.
  The labels of the zones must be identical.
  1. On the system that does not have printer access, assume the System Administrator role.
  2. Change the label of the role workspace to the label of the labeled zone.
  3. Add access to the printer that is connected to the print server of the remote labeled zone.
```
lpadmin -s printer
```
- Configure a labeled zone to use an unlabeled print server for printer access.
  The label of the zone must be identical to the label of the print server.
  1. On the system that does not have printer access, assume the System Administrator role.
  2. Change the label of the role workspace to the label of the labeled zone.
    For details, see How to Change the Label of a Workspace in Solaris Trusted Extensions User’s Guide.
  3. Add access to the printer that is connected to the arbitrarily labeled print server.
```
$ lpadmin -s printer
```

Example 21-1 Using the Print Manager to Enable Printer Access

Rather than run the lpadmin command, choose the Printers –> Add Access to Printer from the Print Manager. The Print Manager must be started in the same zone at the same label as the lpadmin -s printer command.

How to Configure a Restricted Label Range for a Printer

The default printer label range is ADMIN_LOW to ADMIN_HIGH. This procedure narrows the label range for a printer that is controlled by a Trusted Extensions print server.

Before You Begin

You must be in the Security Administrator role in the global zone.

Start the Device Allocation Manager.
- Choose the Allocate Device option from the Trusted Path menu.
- In Trusted CDE, launch the Device Allocation Manager action from the Tools subpanel on the Front Panel.
Click the Device Administration button to display the Device Allocation: Administration dialog box.
Type a name for the new printer.
If the printer is attached to your system, find the name of the printer.
Click the Configure button to display the Device Allocation: Configuration dialog box.
Change the printer's label range.
1. Click the Min Label button to change the minimum label.
  Choose a label from the label builder. For information about the label builder, see Label Builder in Trusted Extensions.
2. Click the Max Label button to change the maximum label.
Save the changes.
1. Click OK in the Configuration dialog box.
2. Click OK in the Administration dialog box.
Close the Device Allocation Manager.