SSO-H (Single Sign-On H)

SSO-H operates with the following system environments:

IMPORTANT
To use Active Directory Authentication, you must match the current time on the server in which Active Directory is running with the machine (and the computer to log in with). When using Server Authentication, make sure you register a Server Authentication administrator. If you do not register a Server Authentication administrator, some settings and management functions may not be available, depending on the application. The registration method differs depending on your system environment. The user that belongs to the "Canon Peripheral Admins" group on Active Directory is the administrator for Server Authentication by default. (You can also set other groups to the administrator.) Follow the instructions in the manual for Active Directory to create the "Canon Peripheral Admins" group, and then register a Server Authentication administrator. If the default password is being used, the screen for changing the password is automatically displayed for security purposes. Change the password. (See "Registering/Editing User Data for Local Device Authentication.")

IMPORTANT

To use Active Directory Authentication, you must match the current time on the server in which Active Directory is running with the machine (and the computer to log in with).

When using Server Authentication, make sure you register a Server Authentication administrator. If you do not register a Server Authentication administrator, some settings and management functions may not be available, depending on the application. The registration method differs depending on your system environment.

The user that belongs to the "Canon Peripheral Admins" group on Active Directory is the administrator for Server Authentication by default. (You can also set other groups to the administrator.) Follow the instructions in the manual for Active Directory to create the "Canon Peripheral Admins" group, and then register a Server Authentication administrator.

If the default password is being used, the screen for changing the password is automatically displayed for security purposes. Change the password. (See "Registering/Editing User Data for Local Device Authentication.")

Windows Server Used for Active Directory Authentication (Domain Controller)

A windows server in which Active Directory is installed and a DNS server for name resolution are necessary to use Active Directory Authentication with SSO-H.

Windows Server to Install Active Directory (Domain Controller)

Software

Operating system:
Windows Server 2008 SP2*1
Windows Server 2008 R2 SP1
Windows Server 2012*2
Windows Server 2012 R2*2
Windows Server 2016*2

*1 64 bit version for the operating system is not supported.

*2 If Kerberos Armoring is enabled in the KDC policy (group policy), users can no longer log in using Active Directory Authentication. Disable Kerberos Armoring to use Active Directory Authentication.

IMPORTANT
This version of SSO-H is compatible with both 128-bit AES (Advanced Encryption Standard) and DES (Data Encryption Standard) as the Kerberos encryption type to be used when performing Domain Authentication. The encryption type automatically switches according to the Active Directory settings. AES is used in an environment that supports both encryption types. If you use Windows Server 2003 R2 SP2 for the Active Directory, only the IPv4 communication protocol is supported (IPv6 cannot be used).

IMPORTANT

This version of SSO-H is compatible with both 128-bit AES (Advanced Encryption Standard) and DES (Data Encryption Standard) as the Kerberos encryption type to be used when performing Domain Authentication. The encryption type automatically switches according to the Active Directory settings. AES is used in an environment that supports both encryption types.

If you use Windows Server 2003 R2 SP2 for the Active Directory, only the IPv4 communication protocol is supported (IPv6 cannot be used).

Server Ports Used

The following server ports are used when using Active Directory Authentication with SSO-H:

Port Number	Application
53	Communication with the DNS server
88	Domain Authentication with the KDC (Key Distribution Center)
389	LDAP communications with the directory service (Default is 389, but it can be changed to a user-defined port in the LDAP service properties.)

Server Used for LDAP Server Authentication

An LDAP server is necessary as an authentication server to use LDAP Server Authentication with SSO-H.

LDAP Server

Software:

OpenLDAP

Operating System:

compliant with specifications for LDAP server products.

Server Ports Used

The following server ports are used when using LDAP Server Authentication with SSO-H:

Port Number	Application
636	LDAP communications with the directory service when TLS is enabled.
389	LDAP communications with the directory service when TLS is disabled.

NOTE
You can change the port number used for SSO-H according to LDAP server settings.

System Requirements for Administrators and General Users

The following system environments are necessary for administrators and general users to use SSO-H via a web browser.

System Requirements

Internet Explorer 11, Microsoft Edge (Windows)

Safari 11 (macOS)

Google Chrome (Windows, macOS)

IMPORTANT
For information on obtaining the Java Runtime Environment or Java 2 Platform Standard Edition, see the Oracle Web site. You must use the user logon name (pre-Windows 2000) registered in Active Directory in order to enter a user name for using Active Directory Authentication. You can use only alphanumeric characters for using Active Directory Authentication. You cannot use symbols (\ / : * ? l <> [ ] ; , = + . "), or spaces. You can log in only if you use valid characters. User names and passwords are registered in a database in the machine. When using the Local Device Authentication system, you can use only alphanumeric characters for the user name.

IMPORTANT

For information on obtaining the Java Runtime Environment or Java 2 Platform Standard Edition, see the Oracle Web site.

You must use the user logon name (pre-Windows 2000) registered in Active Directory in order to enter a user name for using Active Directory Authentication.

You can use only alphanumeric characters for using Active Directory Authentication. You cannot use symbols (\ / : * ? l <> [ ] ; , = + . "), or spaces. You can log in only if you use valid characters.

User names and passwords are registered in a database in the machine.

When using the Local Device Authentication system, you can use only alphanumeric characters for the user name.

NOTE
Port number is a default value. If you change the settings, the port number is different. (See "Before Logging In to SSO-H.") Make sure to enable Cookies and JavaScript in the web browser settings.