Smart Card Authentication Client and eSF Security Manager must be configured correctly for the other Smart Card Authentication applications to function securely. Perform all necessary configuration steps in this section before configuring the other applications.
| Note: Before securing access to the printer, make sure the eSF Security Manager application is installed and running. For more information about eSF Security Manager, see the eSF Security Manager Administrator’s Guide. |
There are two ways to secure access to the printer:
Enable a secure idle screen that restricts access to the entire home screen. When users insert a Smart Card or touch the screen, they will be prompted to authenticate before they can access the home screen.
| Note: The Background and Idle Screen application must be installed and running on the printer to enable this functionality. |
Restrict access to individual applications and functions. Users will be able to access the home screen, but when they touch a secured home screen icon or attempt to use a secured function, they will be prompted to authenticate before they can access that application or function. You can secure access to:
Installed applications, such as Scan to Network
Individual functions of installed applications, such as the Change Background function of the Background and Idle Screen application
Built-in printer functions, such as copy and fax
Users will still be able to access unsecured applications and functions without having to authenticate.
Before you can secure access to applications and functions, you need to create a security template that uses Smart Card Authentication Client to obtain user credentials. You can then assign this security template to each application and function you want to protect.
Create a building block.
From the Embedded Web Server, click Security > Security Setup.
Under the Advanced Security Setup heading, click the building block (or blocks) appropriate for your environment, and then configure it.
| Note: For more information on configuring a specific type of building block, see the “Configuring building blocks” section of the Embedded Web Server Administrator’s Guide for your printer. |
Create a security template.
From the Embedded Web Server, click Settings or Configuration.
Click Security > Security Setup.
Under the Advanced Security Setup heading, click Security Template > Add a Security Template.
Type a name for the security template (for example, ).
From the Authentication Setup menu, select Smart Card Authentication Client, and then click Save Template.
Verify that your template appears in the Manage Security Templates list.
Notes:
From the Manage Security Templates list, select the security template name.
Click Modify Authorization.
From the Authorization Setup menu, select Smart Card Authentication Client.
Click Modify Groups.
Select one or more groups, and then click Save Template.
For more information on configuring security templates and using access controls, see the Embedded Web Server Administrator’s Guide for your printer.
Use this method to require users to authenticate to view and use the printer home screen.
| Note: The Background and Idle Screen application must be installed and running on the printer before you can secure access to the home screen. |
Access the Background and Idle Screen application configuration settings from the Embedded Web Server.
Under the Idle Screen Settings heading, make sure Enable is selected.
In the Start Time field, enter . This prompts the printer to start the secure idle screen immediately (0 seconds) after a user’s login session ends.
Under the Home Screen Background heading, make sure Enable is not selected if you do not want users to be able to change the home screen background image from the printer control panel.
If you want to add custom idle screen images, then click Add under the Idle Screen Images heading.
Type an image name, and then upload the file you want to use.
| Note: For information about compatible image file types and recommended file sizes, see the mouse-over help next to the field. |
Click Apply.
Repeat step 5 through step 7 to add more idle screen images. You can add up to ten images.
If you want to add a custom home screen background image, then under the Home Screen Background heading, select one of the default images, or upload a custom image in the Custom Image field.
| Note: For information about compatible image file types and recommended file sizes, see the mouse-over help next to the field. |
If necessary, configure the other application settings. For more information about configuring Background and Idle Screen, see the Background and Idle Screen Administrator’s Guide.
Click Apply.
Secure access to the idle screen using Smart Card Authentication Client.
On printers running the Embedded Solutions Framework (eSF) version 3.0 or later:
Make sure you have created a security template that uses Smart Card Authentication Client to obtain user credentials. See Setting up a security template.
From the Embedded Web Server, click Settings > Security > Security Setup.
From Step 3 under the Advanced Security Setup heading, click Access Controls.
If necessary, expand the Device Solutions folder.
From the Idle Screen drop-down menu, select your security template.
Click Submit.
On printers running eSF version 2.0:
Access the eSF Security Manager application configuration settings from the Embedded Web Server.
From the Idle Screen drop-down menu, select Smart Card Authentication Client.
Click Apply.
| Note: If you are unsure about which version of eSF your printer is running, then see Checking which version of the Embedded Solutions Framework is installed on a printer. |
Use this method to restrict access to installed applications, such as Scan to Network, or to restrict access to the individual functions of an installed application, such as the Change Background function of the Background and Idle Screen application.
On printers running the Embedded Solutions Framework (eSF) version 3.0 or later:
Make sure you have created a security template that uses Smart Card Authentication Client to obtain user credentials. See Setting up a security template.
From the Embedded Web Server, click Settings > Security > Security Setup.
From Step 3 under the Advanced Security Setup heading, click Access Controls.
If necessary, expand the Device Solutions folder.
For each application or function to which you want to secure access, select your security template from the drop-down menu.
Click Submit.
On printers running eSF version 2.0:
Access the eSF Security Manager application configuration settings from the Embedded Web Server.
For each application or function to which you want to secure access, select Smart Card Authentication Client from the drop-down menu.
Click Apply.
| Note: If you are unsure about which version of eSF your printer is running, then see Checking which version of the Embedded Solutions Framework is installed on a printer. |
Use this method to restrict access to built-in printer functions, such as copy and fax.
Make sure you have created a security template that uses Smart Card Authentication Client to obtain user credentials. See Setting up a security template.
From the Embedded Web Server, click Settings or Configuration, and then click Security > Security Setup.
From Step 3 under the Advanced Security Setup heading, click Access Controls.
If necessary, expand one or more of the access control category folders.
For each function to which you want to secure access, select your security template from the drop-down menu.
Click Submit.
Notes:
You can use the login screen settings to choose how users will be allowed to log in to the printer and whether they will be prompted for a PIN or a password after inserting a Smart Card.
Access the Smart Card Authentication Client application configuration settings from the Embedded Web Server.
Under the Login Screen heading, from the Login Type menu, select how users will be allowed to log in to the printer:
Smart Card Only—This allows users to log in using a Smart Card.
Smart Card or Manual Login—This allows users to log in using either a Smart Card or a user name and password.
Manual Login Only—This allows users to log in using a user name and password.
Notes:
From the Validate Smart Card menu, select whether users will be prompted to type a PIN or a password after inserting a Smart Card.
Click Apply.
Notes:
Access the Smart Card Authentication Client application configuration settings from the Embedded Web Server.
Under the Manual Login Setup heading, in the Manual Login Domain(s) field, specify the domain or domains that will be available for users to select during login. Separate multiple domains with a comma. Domains are case-sensitive and are usually typed in lowercase.
Click Apply.
| Note: This is required only in certain printer models. For other printer models, configuring the Kerberos Authentication system is not required. |
In addition to providing the mechanism for validating login credentials, Smart Card Authentication Client can also be configured to provide Kerberos authentication.
| Note: As with any form of authentication that relies on an external server, users will not be able to access secured applications and functions if a network issue prevents the printer from communicating with the authenticating server. |
Access the Smart Card Authentication Client application configuration settings from the Embedded Web Server.
Under the Smart Card Setup heading, from the Kerberos Information menu, do one of the following:
Select Use device Kerberos setup file to use the Kerberos configuration file (krb5.conf) installed on the printer.
Select Use simple Kerberos setup to enter Kerberos information manually in the Simple Kerberos Setup fields.
Notes:
If you selected Use device Kerberos setup file, then make sure the Kerberos configuration file is installed on the printer.
From the Embedded Web Server, click Settings or Configuration.
Click Security > Security Setup.
From Step 1 under the Advanced Security Setup heading, click Kerberos 5.
Verify that the Kerberos configuration file is installed. If the file is not installed, then under the Import Kerberos File heading, upload the appropriate krb5.conf file, and then click Submit.
If you selected Use simple Kerberos setup, then enter the Kerberos information manually under the Simple Kerberos Setup heading. When you click Apply, the values you entered are used to create a Kerberos configuration file.
Realm—Specify the Kerberos realm as configured in Active Directory. This is typically the Windows domain name. Only one realm can be specified here. To specify multiple realms, customize a Kerberos configuration file and install it on the printer. The realm must be typed in uppercase.
Domain Controller—Specify the IP address or host name of the domain controller or domain controllers used for validation. Separate multiple values with a comma. The domain controllers will be tried in the order listed.
Domain—Specify the domain or domains that should be mapped to the Kerberos realm specified in the Realm field. The domain is the second part of the User Principal Name (UserID@DomainName) on the Smart Card. Type the domain in this format: domain name, comma, period, domain name again. For example, . Multiple domains that map to the specified Kerberos realm can be added here, separated by a comma. For example, . The domain is case-sensitive and is usually typed in lowercase.
Timeout—Specify the number of seconds (3 to 30) to wait for a response from the domain controller before trying the next one listed.
Under the Smart Card Setup heading, from the Domain Controller Validation menu, select the method to use for validating the domain controller certificate:
| Note: Before configuring this setting, make sure the appropriate certificates are installed on the printer. See Installing certificates manually. |
Use device certificate validation—This is the most common method. This method uses the certificate of the Certificate Authority (CA) that issued the domain controller certificate to validate the domain controller certificate. The CA certificate must be installed on the printer.
Use device chain validation—This method uses the entire certificate chain, from the domain controller to the root CA, to validate the domain controller certificate. The entire certificate chain must be installed on the printer.
Use OCSP validation—This method uses the Online Certificate Status Protocol (OCSP) to validate the domain controller certificate. The entire certificate chain, from the domain controller to the root CA, must be installed on the printer, and the settings under the Online Certificate Status Protocol (OCSP) heading must be configured:
Responder URL—Specify the IP address or host name of the OCSP responder/repeater and the port being used (typically 80). Type the value in this format: .
For example, .
Separate multiple values with a comma. The values will be tried in the order listed.
Responder Certificate—Upload the X.509 certificate for the OCSP responder. This certificate is used to validate that the response from the OCSP responder is from a trusted source.
Responder Timeout—Specify the number of seconds (5 to 30) to wait for a response from the OCSP responder before trying the next one listed.
Allow Unknown Status—Select this check box to allow users to log in if the OCSP response indicates that the certificate status is unknown. If the certificate status is unknown and the check box is cleared, then users will not be allowed to log in.
When you are done configuring Smart Card setup settings, click Apply.
Not all networks require you to configure advanced settings. If necessary, adjust the settings to enable the printer to communicate on your network.
Access the Smart Card Authentication Client application configuration settings from the Embedded Web Server.
Under the Advanced Settings heading, configure the following settings:
Session User ID—Select how the user ID will be obtained when a user logs in:
None—The user ID is not set. You can select this option if the user ID is not needed by other applications.
User Principal Name—The User Principal Name (UserID@DomainName) retrieved from the Smart Card or provided during manual login is used to set the user ID.
EDI-PI—The "UserID" portion of the User Principal Name (UserID@DomainName) retrieved from the Smart Card or provided during manual login is used to set the user ID.
LDAP Lookup—The user ID is retrieved from Active Directory.
E-mail From Address—Select where the printer should retrieve the user's e-mail address when sending e-mail.
Smart Card—This retrieves the e-mail address from the user's Smart Card.
LDAP Lookup—This retrieves the user's e-mail address from Active Directory.
Disable Reverse DNS Lookups—If reverse DNS lookups are not used on your network, then select this check box (if available).
On printers running the Embedded Solutions Framework (eSF) version 3.0 or later, this setting is not available from the application configuration settings. If your printer is running eSF version 3.0 or later, then do the following to disable reverse DNS lookups:
From the Embedded Web Server, click Settings > Security > Security Setup.
From Step 1 under the Advanced Security Setup heading, click Kerberos 5.
Under the Kerberos Settings heading, select Disable Reverse IP Lookups.
Click Submit.
| Note: If you are unsure about which version of eSF your printer is running, then see Checking which version of the Embedded Solutions Framework is installed on a printer. |
Wait for user information—For some secured applications to work correctly, additional user information must be placed in the login session. Select this option to retrieve all user information before allowing the user to access the home screen or secured application.
| Note: If you have enabled manual login and you are using the Secure E-mail application along with Smart Card Authentication Client, then you must select this option. This ensures that a manual login user’s e-mail address is stored in the login session and is available for use with Secure E-mail. If this option is not selected, then manual login users cannot send e-mail to themselves automatically. The Secure E-mail “Send me a copy” option will not be available. |
Use SSL for User Info—Select this check box to use an SSL connection to retrieve user information from the domain controller. If this check box is cleared, then a non-SSL connection is used.
Other User Attributes—List any other LDAP attributes that should be added to the user's session. These attributes will be used with other applications. Separate multiple values with a comma.
Group Authorization List—List all Active Directory groups that are authorized to use at least one printer function. Separate multiple groups with a comma. Leave this field blank if you are not using group authorization.
Hosts File—If DNS is not enabled on your network, then upload a text file containing the necessary IP address–host name mappings.
Type the mappings in the text file in this format: IP address, space, server host name. For example, . You can assign multiple host names to an IP address. For example, . You cannot assign multiple IP addresses to a host name. To assign IP addresses to groups of host names, type each IP address and its associated host names on a separate line of the text file. For example:
Click Apply.
You can secure your printer using the Smart Card without the need to maintain a full Kerberos authentication system. The user inserts the Smart Card into the reader and then enters the PIN in the printer home screen. If the Smart Card PIN matches the PIN entered in the home screen matches, then the user can access the application.
Access the Smart Card Authentication Client application configuration settings from the Embedded Web Server.
Under the Login Screen heading, set “Login Type” to Smart Card Only, and then set the Authentication mode to PIN ONLY.
From the Domain Controller Validation menu, select Use device certificate validation.
| Note: The Online Certificate Status Protocol (OCSP) must not be configured. |
Under the Advanced Setting heading, set “E-mail From Address” to Smart Card, and then clear the Wait for user information check box.
| Note: Session User ID must be set to None, and the “Other User Attributes” and “Group Authorization List“ fields must be empty. |
Click Apply.