Lexmark MB2546 Embedded Web Server--Security Administrator s Guide - Page 17

Device Credentials

•

Anonymous LDAP Bind

—Bind the printer with the LDAP server anonymously. This option is applicable

only if your LDAP server allows anonymous binding. Enabling this option does not require you to provide

authentication credentials. This option is available only in the LDAP setup.

•

Use Active Directory Device Credentials

—Use user credentials and group designations that are pulled

from the existing network comparable to other network services. This option is available only in the LDAP

+GSSAPI setup.

•

If

Anonymous LDAP Bind

or

Use Active Directory Device Credentials

is disabled, then provide the

authentication credentials used to bind the printer with the LDAP server.

–

Device Username

•

For LDAP setup, type the fully qualified distinguished name (DN) of a user registered to the LDAP

server.

•

For LDAP+GSSAPI setup, type the DN of a user registered to the Kerberos server.

–

Device Realm

—The realm used for the Kerberos server. This setting is available only in the LDAP

+GSSAPI setup.

–

Device Password

—Type the password for the user.

Advanced Options

•

Use SSL/TLS

—If the LDAP server requires SSL, then select

SSL/TLS

.

•

Require Certificate

—If the LDAP server requires a certificate, then select

Yes

.

•

Userid Attribute

—Type the LDAP attribute to search for when authenticating users’ credentials. The

default value is

sAMAccountName

, which is common in a Windows operating system environment. For

other directories, you can type

uid

,

cn

, or a user-defined attribute. For more information, contact your

system administrator.

•

Mail Attribute

—Type the LDAP attribute that contains the users’ e-mail addresses. The default value is

mail

.

•

Fax number Attribute

—Type the LDAP attribute that contains the users’ fax number. The default value

is

facsimiletelephonenumber

.

•

Full Name Attribute

—Type the LDAP attribute that contains the users’ full names. The default value is

cn

.

•

Home Directory Attribute

—Type the LDAP attribute that contains the users’ home directory. The default

value is

homeDirectory

.

•

Group Membership Attribute

—Type the LDAP attribute required for group search. The default value is

memberOf

.

•

Search Base

—The node in the LDAP server where user accounts reside. You can type multiple search

bases, separated by commas.

Note:

A search base consists of multiple attributes separated by commas, such as cn (common name),

ou (organizational unit), o (organization), c (country), and dc (domain).

•

Search Timeout

—Enter a value from 5 to 30 seconds or 5 to 300 seconds, depending on your printer

model.

•

Follow LDAP Referrals

—Search the different servers in the domain for the logged

‑

in user account.

Managing login methods

17

Section	Page
Contents	2
Change history	4
Overview	5
Supported printers	5
Supported web browsers	7
Securing network connections	8
Accessing the Embedded Web Server	8
Configuring TCP/IP port access settings	8
Configuring IP Security settings	8
Configuring 802.1x authentication	9
Setting the restricted server list	10
Managing devices remotely	11
Using HTTPS for printer management	11
Setting up SNMP	11
Configuring SNMP versions 1 or 2c settings	11
Configuring SNMP version 3 settings	11
Configuring SNMP traps	12
Configuring security audit log settings	12
Updating firmware	13
Managing login methods	14
Restricting public access to functions, applications, printer management, and security options	14
Using local accounts	14
Creating local accounts	14
Editing and deleting local accounts	14
Creating local account groups	15
Editing or deleting local account groups	15
Using LDAP or LDAP+GSSAPI	16
Creating an LDAP or LDAP+GSSAPI login method	16
Editing or deleting LDAP or LDAP+GSSAPI login methods	18
Using Kerberos	19
Creating a Kerberos login method	19
Setting the date and time	19
Using Active Directory	20
Creating an Active Directory login method	20
Editing or deleting an Active Directory login method	21
Creating LDAP, LDAP+GSSAPI, or Active Directory groups	22
Editing or deleting LDAP, LDAP+GSSAPI, or Active Directory groups	23
Understanding access controls	23
Managing certificates	26
Configuring printer certificate defaults	26
Creating a printer certificate	26
Installing certificates manually	27
Installing certificates automatically	27
Viewing, downloading, and deleting a certificate	27
Managing other access functions	28
Scheduling access to USB devices	28
Setting login restrictions	28
Configuring confidential printing	28
Enabling solutions LDAP settings	29
Showing secured applications or functions on the home screen	29
Enabling print permission	29
Enabling the security reset jumper	30
Securing data	31
Erasing printer memory	31
Erasing printer hard disk memory	31
Configuring printer hard disk encryption	31
Restoring factory default settings	31
Statement of Volatility	32
Troubleshooting	33
User is locked out	33
Update the allowed number of login failures and lockout time	33
Reset or replace the smart card	33
User is logged out automatically	33
Increase the Screen Timeout value	33
User cannot access applications or functions	33
Make sure that the user is assigned to a group that has access to the applications and functions	33
KDC and MFP clocks are out of sync	33
Make sure that the date and time settings on the printer are correct	33
Domain controller certificate is not installed	34
Make sure that the correct certificate is installed on the printer	34
KDC is not responding within the required time	34
Make sure that the IP address or host name of the KDC is correct	34
Make sure that the KDC is available in the configuration file	34
Make sure that the server and firewall settings are configured to allow communication between the pr ...	34
LDAP lookups fail	34
Make sure that the server and firewall settings are configured to allow communication between the pr ...	34
If reverse DNS lookup is not used in your network, then disable it in the Kerberos settings	34
If the LDAP server requires SSL, then enable SSL for LDAP lookups	34
Narrow the LDAP search base to the lowest possible scope that includes all necessary users	34
Make sure that all LDAP attributes that are being searched for are correct	34
Notices	35
Edition notice	35
GOVERNMENT END USERS	35
Trademarks	35
GifEncoder	36
ZXing 1.7	36
Apache License Version 2.0, January 2004	36

Lexmark MB2546 Embedded Web Server--Security Administrator s Guide - Page 17

Device Credentials, Advanced Options, Use Active Directory Device Credentials

Page 17 highlights