We have a fairly extensive OpenLDAP setup that we are not willing to move away from. However, I would really like to get my Xerox 7120 users authenticated through LDAP so that I don't have to manage useraccounts locally on the machine. I've gotten all the connectivity up, so the machine can get address books etc from the LDAP server, but I'm having issues with authentication.
I've gotten to the point where the machine can query the server for the user identity entered on the login form, i.e., it sends the queries to the LDAP server correctly. However, what I don't understand is how it wants to check a password. While we are doing regular user authentication with a kerberos server and complex passwords. I would like the xerox users to be able to just use a simple pin, without the need of going through the kerberos server first.
I can easily manage a custom PIN attribute on the LDAP server, and I can remap responses from the server to different attributes if possible, but... I have not been able to find a good place where I can specify what the "PIN" attribute should be, etc... Here's an extract of the connection log that the OpenLDAP server sees when I'm trying to authenticate:
i think you can set it up with the software called "xerox secure access"
but remember , with the XSA accounting you can create reports ... but when you switch to ldap accounting ( with or without xerox secure acces) you cant track reports anymore
or you have to upgrade to equitrac...
I think the Xerox machine tries to bind to your ldap server with the supplied credentials, so by default it will be using the userPassword attribute in the ldap server. I'm not sure if there's any way you could change this.
The trouble with XSA is that there's no automated way to handle bulk accounts in the copier interface, just a web gui to enter/update one user at a time. Which is too painful if you have a lot of users and/or a lot of churn.
I wrote a little perl program to keep the XSA userlist in our copiers up to date (using mysql as a data source but could equally use LDAP). It was pretty easy to use the WWW:Mechanize module to automatically add a list of users. It also downloads the XSA accounting records and puts them back into mysql for us. I only hacked it together a few days ago so it's pretty rough (eg only adds new users, doesn't remove ones who are gone). Anyway, it only took about a half day so far, and about 80 lines of code... maybe worth considering something like this as an alternative.
Thanks for your comments.
If it was using the userPassword, I thought I would have seen that in query sent to the ldap server when the machine is looking up authentication information - but maybe it just expects it in the response which seems strange. There are always ways that we can have the ldap server rewrite both incoming and outgoing queries specifically from the Xerox machine - maybe that'll be the next try. What I can't figure out is what field the password would be in... I will have to test some more.
Uploading user databases is always an option, but I would really prefer not to if at all possible. It seems as if LDAP authentication should be straightforward, but perhaps not. I guess the other way to go might be to add custom principals to the kerberos database for all printer users, and have the machine authenticate against kerberos.
I find it interesting that few seems to have tried ldap authentication. I'll keep trying. If anyone else have ideas, feel free to pitch in.
I've been crazy looking for a possibility to bullk add XSA users (that for us represent client's id numbers) to our brand new ColorQube 9203 (we have 5 of them).
I've no skills of perl but could you please provide your script so that I can charge our machines XSA with more than 2 thousand users. Mannualy is dauting.
Would it be easy to adapt your script so that it could use a CSV file instead of MySQL?
Thanks in advance.
Joao M. Alexandre
maybe a long shot but would you be able to configure the LDAP settings without a Directory Root and with a username/password (anonymous login).
If that does not work start to build from the username/password.