Here's a couple of sections from my /etc/cups/cupsd.conf file that seem to be relevant. I don't understand what they mean, but I'm just betting someone here does:
LogLevel warn
SystemGroup lpadmin root
Group sys
User lp
Listen *:631
Listen /var/run/cups/cups.sock
Browsing On
BrowseAddress @LOCAL
BrowseOrder allow,deny
BrowseAllow all
BrowseLocalProtocols CUPS dnssd
DefaultAuthType Basic
Then farther down, there's this:
</Limit>
<Limit CUPS-Add-Modify-Printer CUPS-Delete-Printer CUPS-Add-Modify-Class CUPS-Delete-Class CUPS-Set-Default CUPS-Get-Devices>
AuthType Default
Require user @SYSTEM
Order deny,allow
To my simple brain, reading this it seems that the only thing I should need is my own user name and password to add or modify a printer, or at worst, "root" as the user and my root password. I am mystified.