Login And Authentication Methods; System Administrator Login [All Product Configurations]; User Authentication - Xerox WorkCentre 7220 Information

3.2. Login and Authentication Methods

There are a number of methods for different types of users to be authenticated. In addition, the connected versions
of the product also log into remote servers. A description of these behaviors follows.

3.2.1. System Administrator Login [All product configurations]

System Administrator Login and access to Tools requires use of either a reserved account "admin", or login into an
account with SA privileges defined in the role. It is stroly recommended that the default password is changed to a
strong alphanumeric password for the "admin" account. The same name and password is used to access CWIS.
A Card reader is available for customers so the user can authenticate to the device with a CAC/PIV/.NET card and
PIN.

3.2.2. User authentication

Users may authenticate to the device using Kerberos, LDAP, SMB Domain, or NDS authentication protocols.
For Kerberos and SMB the WebUI allows an SA to set up a default authentication domain and as many as 8
additional alternate authentication domains.
3.2.2.1. Kerberos Authentication (Solaris or Windows)
The authentication steps are:
1) A User enters a user name and password at the device in the Local UI. The device sends an authentication
request to the Kerberos Server.
2) The Kerberos Server responds with an encrypted key for the user attempting to sign on.
3) The device attempts to decrypt the key using the entered password. The device sends the decrypted key back to
the server. The user is authenticated if the credentials were properly decrypted. The server responds by granting
a Ticket Granting Ticket to the device.
4) The device then logs onto and queries the LDAP server trying to match an email address against the user's Login
Name. The user's email address will be retrieved if the personalization option has been selected on the
Authentication Configuration page.
5) If the LDAP Query is successful, the user's email address is placed in the From: field. Otherwise, the user's login
name along with the system domain is used in the From: field.
6) The user may then add recipient addresses by accessing the Address Book on the LDAP server. Please see the
User Manual for details. Each addition is a separate session to the LDAP server.
Ver. 1.0, January 2013
WorkCentre 7220-7225 Information Assurance Disclosure Paper
Page 30 of 61