2
2
2-155
2-155
Technology > MEAP > Enhanced System Application Management > Server authentication (Active Directory authentication)
Technology > MEAP > Enhanced System Application Management > Server authentication (Active Directory authentication)
■
Server authentication (Active Directory authentication)
●
Outline
It is one of the user authentication methods using SSO-H. User authentication is performed
with the device linked with a domain controller on the network in an Active Directory
environment. It is a user authentication where the user is authenticated by the domain on the
network when the user logs into the device. In addition to users belonging to the domain that
includes the iR device, users belonging to domains that have a reliable relationship with the
domain (multi-domain) can also be authenticated. The domain name of the login destination
can be selected by the users themselves upon login.
Using one of the options (Net Spot Accountant, imageWARE Accounting Manager, or
imageWARE EMC Accounting Management Plug-in) makes it possible to analyze/manage
the iR device usage.
Domain A user
iR Device
Domain B user
Domain controller
（
Active Directory
）
Dmain A
Domain B
Domain controller
（
Active Directory
）
Available
Trusting
relationship
Trusting
relationship
The protocol used is as follows.
• Kerberos:LLS/RLS/ILS
• NTLMV2:WLS(Web Service Login Service)
User information acquisition is done by LDAP, so the Active Directory LDAP port needs to be
made accessible. If LDAP connection fails, the authentication will end in error.
No. of supported domains: 200 (unchanged from SSO) Site access supported.
CAUTION:
In the case of using Server Authentication (Active Directory authentication), it is
necessary to synchronize the time settings of the Active Directory server and the
machine (and the PC for login). If the difference in time setting is 5 minutes or longer,
an error will occur at the time of login. (The setting of the allowable difference in time
can be changed.)
F-2-247
CAUTION:
Since department ID and password are not assigned to domain users, distributing
setting information where the department ID is enabled to a device where the server
authentication is enabled may make the device unable to be logged in. If the device has
become unable to be logged in, follow "Remedy to Be Performed When the Device Has
Become Unable to Be Logged in" in this manual.
●
Access Mode in Sites
With SSO-H, access to Active Directory within site can be prioritized or restricted, so there
is a setting called 'Access Mode in Sites'. Sites programmed in Active Directory comprise
multiple subnets. In this mode, SSO-H uses site information to access the same site as the
device, or the subnet Active Directory.
• The SSO-H default setting is with the site internal access mode OFF.
• Access Active Directory within same site only.
• If there is no Active Directory within the same site, or if connection fails, there will be an
authentication error.
• Access another site if Active Directory within the same site cannot be located.
• If there is no Active Directory within the same site, or if connection fails, an Active Directory
external to the site will be accessed.
• If all attempts to access Active Directory fail, there will be an authentication error.
The operating specifications of the site internal access mode are as described below.
When first logging in to the login service after booting iR, the domain controller (DC) is
obtained from the site list.
However, upon the first login, even if the site functionality is active, connection to DC is
random. (This is because, if connection to DC should fail, the site to which the device belongs
cannot be ascertained.)
If the device IP address or the domain name are changed, the site settings are acquired once
more.
In this mode, at the first login (first authentication of domain to which the device belongs)
LDAP-Bind is performed directly to DC and site information acquired by LDAP from DC.
From the acquired site list, the site to which the device subnet belongs is extracted and this
becomes the site to which device belongs. Active Directory address is acquired (retrieved
from DNS)