Canon iR3245, Service Manual

Page: 380 / 746

Chapter 11
11-34
Default Authentication overview
Default Authentication is the login service that is selected when Department ID management is being used, or when no authentication function has been set. When
Department ID management has been set [ON] in the MEAP device user mode, by entering a seven digit department ID for each department, and a password number
for each department ID, access to the MEAP device can be restricted to those users who enter the code numbers. The department ID and password number can be
entered using the MEAP device touch panel display and Remote UI.
SSO-H (Single Sign-On-H) overview
This is a merger of the existing SDL and SSO login services and has the following features.
- Both the domain authentication and local device authentication login services can be used.
- There is no need to have a separate SA server.
- Login is not via SA, so SSO-H refers directly to DNS for authentication.
- Kerberos and NTML protocols are supported.
- The following three authentication methods may be selected from.
Domain authentication
Local device authentication
Domain authenti local authentication
SSO overview
This is a login service that can be operated on the Active Directory environment network domain and on iR devices. The following user authentication methods
can be selected from.
Domain authentication
Local device authentication
Domain authenti local device authentication
Authentication methods
Both SSO-H and SSO can use multiple authentication methods, and the user can toggle between them from a Web browser. (Refer to the MEAP Authentication
System Settings Guide 'User Authentication Method Settings'.)
Domain authentication
This is a form of user authentication which operates in collaboration with the domain controller on the Active Directory environment network and, as soon as the
iR device is logged into, carries out authentication of the domain on the network. In addition to users belonging to the domain that includes the iR device, users
belonging to domains that have a reliable relationship with the domain (multi-domain) can also be authenticated. The domain name of the login destination can be
selected by the users themselves upon login.
The function makes use of options Net Spot Accountant/ iW Accounting Manager/ iW EMC Accounting MAnagement Plig-in to enable analysis and management
of the iR device usage status.
Depending on the login service, different protocols are used.
- SSO-H
- Kerberos:LLS/RLS/ILS
- NTLMV2:WLS(Web Service Login Service. WLS can only be used in collaboration with iW AMS Ver2 AMS printer driver add-in and iWEMC user
management plug-in.)
- SSO
- NMTLM only
User information acquisition is done by LADP, so the Active Directory LDAP port needs to be made accessible.
If LDAP connection fails, the authentication will end in error.
No. of supported domains: 200 (unchanged from SSO)
Site access supported.
Important information when using conventional SSO and SDL
- When the login method setting is for SDL, the information registered in SDL must match the Department ID management user information (department ID and
password).
- When the login method setting is for SDL and SSO, Department ID management needs to be [OFF] before making any changes. To use SDL and Department ID
management together, switch the login service to SDL and then turn the Department ID management ON.
- To run Department ID management when the setting is for SSO, the options Net Spot Accountant / imageWARE Accounting Manager are required.
- When the setting is SSO, the option card reader cannot be used.
- When using SSO, the clock settings of the server managing the Active Directory and the MEAP device (and the PC used to log in), must be matched. If there is a
time difference of greater than 30 minutes in the clock settings, an error will be generated when login is attempted with SSO.
- When the setting is for SDL or SSO, startup may take a little longer.
...To use the SEND function when the setting is for SDL and SSO, when sending email, mail addresses need to be programmed against each user. If they are not,
email cannot be sent. Note, however, that when sending i-Fax, the mail addresses set in the device are used.
- The system configuration is different from previous SSO, so individual management is required.
- If MEAP is supported, installation into devices prior to SSO-H release is possible.
- Data porting of user information that was being used with the earlier SSO local device authentication and SDL can be done by exporting/ importing. However,
application settings information cannot be ported.
SSO was pre-installed in earlier released devices, but from iR3245 onward it will only be provided with the Administrator's CD.
The factory shipment setting is 'Domain authenti local device authentication'. In order to provide increased security, as soon as SSO is used, it is recommended
that the administrator's user name and password in local device authentication be changed from the factory shipment settings as soon as possible.