Lexmark X864 PKI-Enabled Device Installation and Configuration Guide - Page 13

Active Directory Configuration Note: As with any form of authentication that relies on an external server, users will not be able to access protected device functions in the event a network issue prevents the printer from communicating with the authenticating server. 1 From the Embedded Web Server, click Settings > Embedded Solutions > PKI Authentication > Configure. 2 Under Active Directory Configuration, select a User Validation Mode: • PIN Only-Users are validated locally with SmartCard and PIN. Network functions that require authentication will not be available to users. • Active Directory-Users are validated against Active Directory with SmartCard and PIN. 3 Select Use MFP Kerberos Setup to use the Kerberos settings already configured on the printer, or clear the check box to use Simple Kerberos Setup. 4 For Simple Kerberos Setup you must provide: • Realm-The Kerberos realm as configured in Active Directory; typically the Windows Domain Name. The Realm must be entered in UPPERCASE. • Domain Controller-IP address or hostname of the domain controller used for validation. Multiple values can be entered, separated by commas; they will be tried in the order listed. • Domain-The SmartCard domain that should be mapped to the specified Realm. This is the principal name used on the SmartCard, and should be listed by itself, followed by a comma, a period, and then the principal name again. This value is case-sensitive, and usually appears in lowercase. Multiple values can be entered, separated by commas. Example: If a U.S. DoD Common Access Card uses "123456789@mil" to identify a user, "mil" is the principle name. In this case, you would enter the Domain as "mil,.mil". • Timeout-The amount of time the printer should wait for a response from the domain controller before moving to the next one in the list. 5 If users are allowed to login manually, provide at least one Manual Login Domain (a Windows Domain Name) to choose from when logging in. Multiple domains can be entered, separated by commas. 6 Select a DC Validation Mode for validating the domain controller certificate when users login to the printer: • Device Certificate Validation-The most common method. The certificate of the CA that issued the domain controller certificate must also be installed on the printer. • MFP Chain Validation-The entire certificate chain, from the domain controller to the root CA, must be installed on the printer. • OCSP Validation-The entire certificate chain, from the domain controller to the root CA, must be installed on the printer, and Online Certificate Status Protocol (OCSP) settings must be configured. 7 If you selected OCSP Validation, configure the following: • Responder URL-The IP address or hostname of an OCSP responder/repeater, along with the port being used (usually 80). The correct format is "http://ip_address:port_number" (http://255.255.255.0:80). Multiple values can be entered, separated by commas; they will be tried in the order listed. • Responder Certificate-Browse to locate the X.509 certificate for the responder. • Responder Timeout-The amount of time the printer should wait for a response from the OCSP Responder before moving to the next one in the list. • Unknown Status is Valid-Select this check box if you want to allow users to login even if the OCSP response indicates the certificate status is unknown. 8 Continue to User Session and Access Control, or click Apply at the bottom of the screen to save changes. Configuring PKI-enabled devices 13