So I need to do authorized printing on Mac OS X.

I can define an NDPS printer, via iPrint/NDPS, and use CUPS on the Mac
to print to it over IPP. No problems.

Now I need to allow one queue/PA to everyone and one to only users in a
certain container. (Free versus pay printing in a computer lab).

Seems obvious how... Switch to IPPS, enable SSL and high security on
the NDPS side, and allow only the users I want in NDPS.

Works fine on Win32 with the Client32 NDPS bits, or with the iPrint

Now I need the same on a Mac...

Any hints on getting IPPS working on a Macintosh? Where does the
authentication happen? Can it/Does it forward the login credentails to
the CUPS IPP stack? That would be cool, though I doubt it...