--- a/usr/src/lib/libpam/pam.conf	Fri Oct 24 12:57:08 2008 -0700
+++ b/usr/src/lib/libpam/pam.conf	Fri Oct 24 15:30:02 2008 -0700
@@ -19,9 +19,7 @@
 # CDDL HEADER END
 #
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
-#
-# Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
+# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
 # PAM configuration
@@ -96,6 +94,9 @@
 #
 cron	account required	pam_unix_account.so.1
 #
+# cups service (explicit because of non-usage of pam_roles.so.1)
+#
+cups	account	required	pam_unix_account.so.1
 #
 # Default definition for Account management
 # Used when service name is not explicitly mentioned for account management

--- a/usr/src/pkgdefs/common_files/i.pamconf	Fri Oct 24 12:57:08 2008 -0700
+++ b/usr/src/pkgdefs/common_files/i.pamconf	Fri Oct 24 15:30:02 2008 -0700
@@ -20,8 +20,6 @@
 # CDDL HEADER END
 #
 #
-#ident	"%Z%%M%	%I%	%E% SMI"
-#
 # Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
 # Use is subject to license terms.
 #
@@ -30,6 +28,7 @@
 KERB_ENTRIES=$PAM_TMP/scr.$$
 PPP_ENTRIES=$PAM_TMP/scp.$$
 CRON_ENTRIES=$PAM_TMP/scc.$$
+CUPS_ENTRIES=$PAM_TMP/scd.$$
 mkdir $PAM_TMP  || exit 1
 
 PATH="/usr/bin:/usr/sbin:${PATH}"
@@ -71,6 +70,15 @@
 EOF
 }
 
+setup_cups_changes(){
+#
+# No comments or blanks lines allowed in entries below
+#
+cat > ${CUPS_ENTRIES} << EOF
+cups		account		required	pam_unix_account.so.1
+EOF
+}
+
 #  Returns zero (success) if system is labeled (aka Trusted Extensions).
 #  1 otherwise.
 #
@@ -105,6 +113,7 @@
 setup_kerb_changes
 setup_ppp_changes
 setup_cron_changes
+setup_cups_changes
 while read src dest
 do
     if [ ! -f $dest ] ; then
@@ -297,6 +306,30 @@
 		    >> ${CLEANUP_FILE}
     		rm -f /tmp/pamconf.$$
     	fi
+#
+# update pam.conf to append cups entries if not already present
+#
+	rm -f /tmp/pamconf.$$
+	while read e1 e2 e3 e4 e5
+	do
+		# See if the entry already exists
+		grep \
+"^[# 	]*$e1[ 	][ 	]*$e2[ 	][ 	]*$e3[ 	][ 	]*$e4" \
+		$dest >/dev/null 2>&1
+		if [ $? = 1 ] ; then
+			# Doesn't exist, enter into pam.conf
+			echo "$e1\t$e2 $e3\t\t$e4 $e5" >> /tmp/pamconf.$$
+		fi
+	done < ${CUPS_ENTRIES}
+	# Append cups lines if any were not present already.
+	if [ -f /tmp/pamconf.$$ ] ; then
+		cat /tmp/pamconf.$$ >> $dest
+		echo "${dest} updating entries for cups, \c" \
+		    >> ${CLEANUP_FILE}
+		echo "please examine/update any new entries" \
+		    >> ${CLEANUP_FILE}
+    		rm -f /tmp/pamconf.$$
+    	fi
 
 #
 # update pam.conf to remove the rlogin entry that uses pam_krb5.so.1