BUS Updated 12/2011
07/2011
6-59
WorkCentre 5335 Family Service Documentation
GP 21
General Procedures & Information
Initial Issue
4.
The user’s digital Certificate is read from the card.
Steps to validate the Chain of Trust
5.
The WorkCentre may be configured to validate the Domain Controller (DC) certificate. If
so it submits the DC Certificate and any associated Trusted Root Certificates, to the
Online Certificate Status Protocol (OCSP) Responder, to verify that the Domain Controller
certificate is valid and not revoked.
6.
The system receives a response from the OCSP responder stating whether the certificate
is valid and has not been revoked.
Authenticating with the Domain Controller
7.
The system calls the Domain Controller using the PKINIT protocol to validate the CAC
user’s Certificate.
8.
The Domain Controller (Kerberos) returns an encrypted challenge.
9.
The WorkCentre decrypts the challenge using the private key from the Domain Controller
Certificate that was downloaded on the WorkCentre. The Domain Controller then pro-
vides a decrypted session key that the machine uses to decode subsequent communica-
tion with the DC.
10. The CAC User’s Identity certificate is passed to the Domain Controller for Authorization.
11.
If successful, the Domain Controller returns a Ticket Granting Ticket (TGT). Authentication
is complete and Authorization begins.
12. At this point authorization is complete and the authorized services such as (scan to e-
mail, copy & fax) are now available.
13. The E-mail address is retrieved from the Signing Certificate and is available for inclusion
in the From: field whenever the E-mail Service is selected.
14. The session is terminated when the card is removed from the reader, or the administrator
settable timeout expires.
CAC Feature Limitations:
•
The CAC solution requires the Scan option to be installed.
•
When CAC authentication is enabled on the device the Copy Feature is locked by default
and can only be accessed once the user has successfully authenticated.
Possible Fault Codes That May Be Observed
•
021-210:USB Card Reader connection error.
•
021-211:USB Card Reader broken.
•
021-212:USB Card Reader couldn’t start.
•
018-725:Users Kerberos password has expired. Please ask system administrator of KDC
to extend password expiration date or change password.
•
018-726:Not all of Certificate Authority certificate(s) of the CAC Root and Intermediate
certificates are registered in device.
•
018-727:Check that CAC certificate is valid, or that the CAC user is registered on the con-
figured Domain Controllers.
•
018-728:Check that the Domain Controller Certificate is invalid.
•
016-533:Domain Controller server clock-skew error. Enable NTP.
•
016-534:Could not connect with the configured Domain Controller realm.
•
016-539:Fatal error on the Domain Controller.
•
016-231:A fault or an error has occurred with the CAC Card Reader.