2
2
2-157
2-157
Technology > MEAP > Enhanced System Application Management > Server Authentication (LDAP Authentication)
Technology > MEAP > Enhanced System Application Management > Server Authentication (LDAP Authentication)
1) SSO-Tokyo acquires site lists from Active Directories.
Note, however, that the Active Directories accessed in order to acquire site lists are in the
order in which they were returned by DNS, so there is no guarantee that the same Active
Directory will be accessed as in the initial settings (upon device settings or changes to NW
settings, etc.).
[Site subnet list]
Site: Tokyo: = 172.24.12.0/24, 172.24.35.0/24
Site: Osaka: = 192.168.1.0/24
Site: Hakata: = 211.111.1.0/24
As a result, since SSO-Tokyo is 172.24.12.80, the subnet is 172.24.12.0/24, and is judged
as belonging to site Tokyo.
2) The DNS server obtains its Active Directory list from the primary or secondary DNS, as set
in the device.
[Active Directory]
172.24.12.2, 172.24.35.2, 192.168.1.2, 211.111.1.30
3) Of the Active Directories in 2), above, the ones that belong to the same site (Tokyo) are
172.24.12.2 and 172.24.35.2.
Of these, the Active Directory that is the same subnet as SS-Tokyo is 172.24.12.2.
Therefore, this one will be accessed.
4) If access fails at step 3), above, the other Active Directory of the same site, 172.24.35.2,
will be accessed.
5) If access fails at step 4), above, also, SSO-Osaka and SSO-Hakata will be accessed (the
order will depend on the order of the Active Directories in DNS). Note, however, that this is
an optional operation.
Logging into other domains at multi-domain
At multi-domain, if another domain is logged into, based on the site/ subnet information
retrieved in the home domain, the Active Directories of the login destination domain/ KDC
address list are computed. In the event that the domain controller IP addresses of other
domains are outside of the site access range, and only the domain controller within the site
is programmed for access, an error message will be displayed to the effect that the site
information is incorrect.
■
Server Authentication (LDAP Authentication)
It is one of the user authentication methods using SSO-H. User authentication is performed
with the device linked with the LDAP Server on the network in an LDAP environment.
iR Device
LDAP Server
Local user
Remote user
LDAP server authentication can be used for devices that support MEAP User Preference
Service (MEAP Specification Ver.56) and MEAP Application Setting Information Management
(MEAP Specification Ver.57).
As for models that do not support MEAP User Preference Service and MEAP Application
Setting Information Management , [LDAP Server] cannot be selected as the type of the
authentication server on the SSO-H Configuration page. Moreover, it is not possible to access
the LDAP Server Management screen and the Add Server screen.
Simple bind (a method where the password is not encrypted) is used as the bind
(authentication) between SSO-H and LDAP server. It is therefore strongly recommended to
always use SSL connection from a security standpoint.
As for the version of LDAP, only Ver.3 is supported.
ON/OFF of SSL connection can be changed on the LDAP Server Management page.
The time-out value of connection is 60 seconds.
In the case of using LDAP server authentication, the characters entered as the user name are
not case-sensitive, but the characters entered as the password are case-sensitive.
In the case of SSO-H, authentication is not allowed when the user name includes "* (asterisk)".
If authentication is performed with "* (asterisk)" used in the user name, an authentication error
occurs.
F-2-250