SSO-H (Single Sign-On H)

SSO-H operates with the following system environments:

IMPORTANT
To use Active Directory Authentication, you must match the current time on the server in which Active Directory is running with the machine (and the computer to log in with). When using Server Authentication, make sure you register a Server Authentication administrator. If you do not register a Server Authentication administrator, some settings and management functions may not be available, depending on the application. The registration method differs depending on your system environment. The user that belongs to the "Canon Peripheral Admins" group on Active Directory is the administrator for Server Authentication by default. (You can also set other groups to the administrator.) Follow the instructions in the manual for Active Directory to create the "Canon Peripheral Admins" group, and then register a Server Authentication administrator. If the default password is being used, the screen for changing the password is automatically displayed for security purposes. Change the password. (See "Registering/Editing User Data for Local Device Authentication.")

IMPORTANT

To use Active Directory Authentication, you must match the current time on the server in which Active Directory is running with the machine (and the computer to log in with).

When using Server Authentication, make sure you register a Server Authentication administrator. If you do not register a Server Authentication administrator, some settings and management functions may not be available, depending on the application. The registration method differs depending on your system environment.

The user that belongs to the "Canon Peripheral Admins" group on Active Directory is the administrator for Server Authentication by default. (You can also set other groups to the administrator.) Follow the instructions in the manual for Active Directory to create the "Canon Peripheral Admins" group, and then register a Server Authentication administrator.

If the default password is being used, the screen for changing the password is automatically displayed for security purposes. Change the password. (See "Registering/Editing User Data for Local Device Authentication.")

Windows Server Used for Active Directory Authentication (Domain Controller)

A windows server in which Active Directory is installed and a DNS server for name resolution are necessary to use Active Directory Authentication with SSO-H.

Windows Server to Install Active Directory (Domain Controller)

Software

Operating system:
Windows Server 2008 SP2*1
Windows Server 2008 R2 SP1
Windows Server 2012*2
Windows Server 2012 R2*2

*1 64 bit version for the operating system is not supported.

*2 If Kerberos Armoring is enabled in the KDC policy (group policy), users can no longer log in using Active Directory Authentication. Disable Kerberos Armoring to use Active Directory Authentication.

IMPORTANT
This version of SSO-H is compatible with both 128-bit AES (Advanced Encryption Standard) and DES (Data Encryption Standard) as the Kerberos encryption type to be used when performing Domain Authentication. The encryption type automatically switches according to the Active Directory settings. AES is used in an environment that supports both encryption types. If you use Windows Server 2003 SP2/R2 SP2 for the Active Directory, only the IPv4 communication protocol is supported (IPv6 cannot be used).

IMPORTANT

This version of SSO-H is compatible with both 128-bit AES (Advanced Encryption Standard) and DES (Data Encryption Standard) as the Kerberos encryption type to be used when performing Domain Authentication. The encryption type automatically switches according to the Active Directory settings. AES is used in an environment that supports both encryption types.

If you use Windows Server 2003 SP2/R2 SP2 for the Active Directory, only the IPv4 communication protocol is supported (IPv6 cannot be used).

Server Ports Used

The following server ports are used when using Active Directory Authentication with SSO-H:

Port Number	Application
53	Communication with the DNS server
88	Domain Authentication with the KDC (Key Distribution Center)
389	LDAP communications with the directory service (Default is 389, but it can be changed to a user-defined port in the LDAP service properties.)

Server Used for LDAP Server Authentication

An LDAP server is necessary as an authentication server to use LDAP Server Authentication with SSO-H.

LDAP Server

Software:

Novell eDirectory V8.8 SP6 for Windows

Lotus Domino 8.5 for Windows

Operating System:

compliant with specifications for LDAP server products.

Server Ports Used　

The following server ports are used when using LDAP Server Authentication with SSO-H:

Port Number	Application
636	LDAP communications with the directory service when TLS is enabled.
389	LDAP communications with the directory service when TLS is disabled.

NOTE
You can change the port number used for SSO-H according to LDAP server settings.

System Requirements for Administrators and General Users

The following system environments are necessary for administrators and general users to use SSO-H via a web browser.

System Requirements

Operating System	Web Browser	Java Runtime Environment
Windows Vista SP2	Internet Explorer 7 Internet Explorer 8 Internet Explorer 9	Java Runtime Environment 5.0 Java SE Runtime Environment 6*1 Java SE Runtime Environment 7
Windows 7 SP1	Internet Explorer 8 Internet Explorer 9 Internet Explorer 10 Internet Explorer 11
Windows 8	Internet Explorer 10 Internet Explorer 11
Windows 8.1	Internet Explorer 11
Windows 10	Internet Explorer 11
Windows Server 2008 SP2	Internet Explorer 7 Internet Explorer 8 Internet Explorer 9
Windows Server 2008 R2 SP1	Internet Explorer 8 Internet Explorer 9
Windows Server 2012 R2	Internet Explorer 11
Mac OS X v 10.5	Safari 4.0.5 Safari 5.0.5	Java 2 Platform Standard Edition 5.0 Java Platform Standard Edition 6
Mac OS X v 10.6	Safari 4.0.5 Safari 5.0.5 Safari 5.1	Java Platform Standard Edition 6*2
Mac OS X Lion	Safari 5.1	Java Platform Standard Edition 6 Java Platform Standard Edition 7
Mac OS X Mountain Lion	Safari 6.0	Java Platform Standard Edition 7
Mac OS X Mavericks	Safari 7.0	Java Platform Standard Edition 7

*1 When using Java SE Runtime Environment 6 with Internet Explorer 9, use the version 1.6.0_24 or later.

*2 When using Safari 5.0.5, use the version 1.6.0_26 or earlier.

System Requirements (When Using IPv6 Communications)

Operating System	Web Browser	Java Runtime Environment
Windows Vista SP2	Internet Explorer 7 Internet Explorer 8 Internet Explorer 9	Java Runtime Environment 5.0 Java SE Runtime Environment 6*1 Java SE Runtime Environment 7
Windows 7 SP1	Internet Explorer 8 Internet Explorer 9 Internet Explorer 10 Internet Explorer 11*3
Windows 8	Internet Explorer 10 Internet Explorer 11*3
Windows 8.1	Internet Explorer 11*3
Windows 10	Internet Explorer 11
Windows Server 2008 SP2	Internet Explorer 7 Internet Explorer 8 Internet Explorer 9
Windows Server 2008 R2 SP1	Internet Explorer 8 Internet Explorer 9
Windows Server 2012 R2	Internet Explorer 11*3

*1	When using Java SE Runtime Environment 6 with Internet Explorer 9, use the version 1.6.0_24 or later.
*3	When using Internet Explorer 11 to open the login screen, an error message may appear indicating that the Java Runtime Environment is not installed, even if the Java Runtime Environment is installed. If this error occurs, set the Compatibility View Settings for Internet Explorer so that the Remote UI is displayed in the Compatibility View.

IMPORTANT
For information on obtaining the Java Runtime Environment or Java 2 Platform Standard Edition, see the Oracle Web site. You must use the user logon name (pre-Windows 2000) registered in Active Directory in order to enter a user name for using Active Directory Authentication. You can use only alphanumeric characters for using Active Directory Authentication. You cannot use symbols (\ / : * ? l <> [ ] ; , = + . "), or spaces. You can log in only if you use valid characters. User names and passwords are registered in a database in the machine. When using the Local Device Authentication system, you can use only alphanumeric characters for the user name.

IMPORTANT

For information on obtaining the Java Runtime Environment or Java 2 Platform Standard Edition, see the Oracle Web site.

You must use the user logon name (pre-Windows 2000) registered in Active Directory in order to enter a user name for using Active Directory Authentication.

You can use only alphanumeric characters for using Active Directory Authentication. You cannot use symbols (\ / : * ? l <> [ ] ; , = + . "), or spaces. You can log in only if you use valid characters.

User names and passwords are registered in a database in the machine.

When using the Local Device Authentication system, you can use only alphanumeric characters for the user name.

NOTE
Port number is a default value. If you change the settings, the port number is different. (See "Before Logging In to SSO-H.")