Canon imageRUNNER ADVANCE C3330 Series, Service Manual

Page: 159 / 1225

• LDAP server (to obtain attributes of the user that is logged in)
• DNS server (to search for the KDC and LDAP servers)
<Supported environment>
• Microsoft Windows Server 2003 SP2 (64-bit version is not supported.)
• Microsoft Windows Server 2003 R2 SP2 (64-bit version is not supported.)
• Microsoft Windows Server 2008 SP2 (64-bit version is not supported.)
• Microsoft Windows Server 2008 R2 SP1
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
<Servers supporting IPv6 environments>
• Microsoft Windows Server 2008 SP2 (64-bit version is not supported.)
• Microsoft Windows Server 2008 R2 SP1
• Microsoft Windows Server 2012
• Microsoft Windows Server 2012 R2
CAUTION:
Make sure to set the time of the server and the time of the device to be within a certain difference.
With Kerberos authentication, the time of the authentication server (KDC) and authentication client must be synchronized
within a certain difference. The allowed difference is whichever one of the following is shorter.
• 5 minutes (hard-coded User Authentication setting)
• [Maximum tolerance for computer clock synchronization] in the [Kerberos Policy] setting of the authentication server
synchronization
To perform RLS authentication when SSL is disabled, the time of the client PC must be set to be synchronized with the
authentication server.
LDAP authentication
When using LDAP authentication by SSO-H, the following conditions need to be satisfied.
<LDAP server>
• Novell eDirectory V8.8 SP7
• Lotus Domino V8.5
NOTE:
It should comply with the specifications of the LDAP server product.
Operation check has been conducted for the following OS.
• Microsoft Windows Server 2003 Enterprise SP2
• Microsoft Windows Server 2008 Enterprise SP2 (x86)
• Microsoft Windows Server 2012Microsoft Windows Server 2008 Enterprise SP2 (x86)
Settings Common to Active Directory Authentication and LDAP Authentication
<Device settings>
When using LDAP authentication, the following settings must be appropriately specified.
• TCP/IP settings
• DNS server settings (when using Active Directory as the authentication server)
• Date and time settings (when using Kerberos authentication with Active Directory)
<DNS server settings>
When setting the DNS server, the following conditions must be met.
• The DNS domain name of the authentication server can be resolved
• The port number used by LDAP/the Kerberos service can be obtained from the DNS server with User Authentication
• The protocol used by the SRV record information of the LDAP service is "_tcp" and the service name is "_ldap"
• The protocol used by the SRV record information of the Kerberos service is "_udp" and the service name is "_kerberos"
● User Authentication Methods
User Authentication includes Local Device Authentication and Server Authentication as user authentication methods. Local
Device Authentication uses the user database registered in the device to perform authentication while Server Authentication uses
an authentication server on a network to perform user authentication.
As the setting, either "Local Device Authentication" or "Local Device Authenti Server Authentication" can be selected.
If "Local Device Authenti Server Authentication" is selected, such operation is possible in which Server Authentication is
used to authenticate users registered in the authentication server at normal times while Local Device Authentication is used when
it is necessary to temporarily authenticate users that cannot be added to the authentication server. Also, if a problem occurs with
the authentication server, Local Device Authentication can be used until the server recovers.
2. Technology
147