PaperCut Xerox EIP2 Embedded Manual

PaperCut Xerox EIP2 Embedded Manual
PaperCut Xerox Secure Access EIP
1.5+ Manual
Contents
1
2
Overview ........................................................................................................................... 4
1.1
Consistency:............................................................................................................... 4
1.2
Integration: ................................................................................................................ 4
1.3
Rate of development: ................................................................................................ 4
1.4
Vendor Neutral: ......................................................................................................... 4
1.5
Security: ..................................................................................................................... 5
Installation ........................................................................................................................ 6
2.1
Xerox Device Compatibility ....................................................................................... 6
1.1
Requirements ............................................................................................................ 7
2.2
Migrating from EIP 1.0 to EIP 1.5+ Xerox Devices ..................................................... 8
2.3
Card Reader support ................................................................................................. 9
2.3.1
Network Card Readers....................................................................................... 9
2.3.2
USB Card Readers .............................................................................................. 9
2.4
3
Setup Procedure ...................................................................................................... 10
2.4.1
Introduction ..................................................................................................... 10
2.4.2
Networking/Firewall Configuration ................................................................. 10
2.4.3
Enable the HTTPS/SSL protocol ....................................................................... 10
2.4.4
Check SNMP version 2 Configuration .............................................................. 11
2.4.5
Create/setup the Xerox device in PaperCut .................................................... 12
2.4.6
Enable Xerox Secure Access (XSA) Authentication Settings ............................ 13
2.4.7
Verify Xerox Secure Access (XSA) Authentication Settings ............................. 15
2.4.8
Accounting Configuration on EIP 1.5 devices .................................................. 18
2.4.9
Ensure copier functions only accessed by logging in. ..................................... 19
2.4.10
Verify and Enable Extensible Interface Platform Settings ............................... 22
2.4.11
(Optional) Enable network card reader ........................................................... 23
2.4.12
(Optional) Additional Network Security .......................................................... 24
Post-install testing .......................................................................................................... 25
3.1
Test Preparation ...................................................................................................... 25
3.2
Scenario 1: Standard copying .................................................................................. 26
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights
Reserved.
1 of 50
| Xerox EIP 1.5+ Embedded Manual
3.3
Scenario 2: Copying with account selection ............................................................ 27
3.3.1
4
5
2015-12-17
Verify Account Tracking in PaperCut ............................................................... 28
3.4
Scenario 3: Print release .......................................................................................... 29
3.5
Scenario 4: Scanning and faxing .............................................................................. 30
Configuration .................................................................................................................. 32
4.1
Device Function ....................................................................................................... 32
4.2
Authentication Methods ......................................................................................... 32
4.3
Configuring Swipe Card Readers ............................................................................. 33
4.4
Single Sign On (SSO) ................................................................................................ 34
4.5
Customizing the Header Logo ................................................................................. 34
Known Limitations and Security ..................................................................................... 35
5.1
EIP 1.5 device limitations summary......................................................................... 35
5.2
No Zero Stop for EIP 1.5 devices ............................................................................. 35
5.3
Account selection limitation and login without credit limitation for EIP 1.5 devices
35
5.4
Cannot have free scanning/faxing and stop users from logging in with insufficient
balance on EIP 1.5 devices. ................................................................................................. 36
5.4.1
Disable the Job Accounting for scanning ......................................................... 36
5.4.2
In Secure Access, turn off authentication for scanning ................................... 36
5.5
No Tracking or Zero Stop for USB Printing .............................................................. 37
5.6
No Zero Stop for Faxing ........................................................................................... 37
5.7
Fax Tracking ............................................................................................................. 37
5.8
User Interface .......................................................................................................... 38
5.9
Bypassing the System .............................................................................................. 38
5.10
Card Reader support for authentication ................................................................. 38
5.11
Job Assembly not supported by default on EIP 2.0+ ............................................... 38
5.11.1
6
Turning Off Job Limits’ Preauthorization ......................................................... 39
5.12
Unable to bypass authentication for custom Apps/Services .................................. 40
5.13
Less automatic configuration on EIP 1.5 devices .................................................... 41
Advanced Configuration ................................................................................................. 41
6.1
Config Editor ............................................................................................................ 41
6.2
Setting an explicit PaperCut Server Network Address ............................................ 45
7
How it works ................................................................................................................... 47
8
FAQ & Troubleshooting .................................................................................................. 47
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
2 of 50
| Xerox EIP 1.5+ Embedded Manual
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
2015-12-17
3 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
This manual covers the setup of Xerox Secure Access EIP 1.5+ (e.g. EIP 1.5, EIP 2.x, EIP 3.x).
For general PaperCut MF documentation, please see the PaperCut MF manual.
1 Overview
This manual provides an overview of the installation, configuration and operation of
PaperCut’s embedded software MFD (Multi-Function Device) solutions. Today’s MFDs are
smarter – they have touch screens and offer the ability to run applications directly on the
device. The goal of the PaperCut Software’s embedded MFD solution is to leverage these
smart devices and to provide walk-up copier users with the same set of rich application
features provided in the print control area. These include:





End user authentication including integration with single sign-on environments
Monitoring and control of photocopying, scanning and faxing (quotas, charging,
allocation and logging)
Allocation of copying, scanning and faxing to accounts/departments/costcenters/projects
Release jobs from a hold/release queue (secure printing)
Group based access control: Limit access to the device to members of selected user
groups.
Highlights of the embedded solution include:
1.1 Consistency:
The embedded solutions are developed in-house by the PaperCut Software development
team. This ensures that the copier interface is consistent with the workstation print
interface, meaning users only have to learn one system.
1.2 Integration:
PaperCut is a single integrated solution where print, internet and copier control are all
managed in the one system. Users have a single account and administrators have the same
level of reporting and administration for all services. The embedded solution interacts with
the PaperCut server using a Service Oriented Architecture (SOA) and web services based
protocols.
1.3 Rate of development:
PaperCut is developed under a release-often policy where new features are made available
to users as soon as they are complete. Unlike hardware based solutions, new versions can
be delivered to users regularly as software updates.
1.4 Vendor Neutral:
PaperCut remains true to its vendor neutral stance. All embedded solutions are equal and
support all server OS’s including Windows, Linux and Mac.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
4 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
1.5 Security:
A large percentage of PaperCut’s user base operates in the Education environment where
security is integral. All embedded solutions are developed with security in mind. Any
security objectives that cannot be satisfied are fully disclosed.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
5 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
2 Installation
This section covers the installation of the PaperCut embedded application for compatible
Xerox devices. The embedded application will allow the control, logging and monitoring of
walk-up off-the-glass MFD usage and may also serve as a print release station for network
prints (for information on just tracking network printing see the PaperCut user manual).
2.1 Xerox Device Compatibility
This document covers the PaperCut Xerox Secure Access EIP 1.5+ embedded solution. This
solution supersedes the older Secure Access solution and is recommended for all devices
that support the Extensible Interface Platform (EIP) version 1.5 or higher.
EIP includes the Xerox Secure Access feature, which allows the PaperCut server to
authenticate users at the MFP device. For EIP 2 devices it also includes a Job Limits feature,
which allows PaperCut to more strictly enforce print quotas.
The PaperCut Xerox EIP 1.5+ solution includes:




A full screen interface for Print Release – allowing individual print jobs to be viewed
and released.
A full screen interface for Account Selection – allowing accounts to be selected from
a list, by search string, or by code.
For EIP 2 devices, “Zero Stop” enforcement of copy and scan operations using the
Job Limits feature.
Easier device setup and configuration
PaperCut implements Zero Stop for Copy and Scan jobs to prevent users from overrunning
their available credit. Note that this capability is not supported by EIP 1.5 devices.
Zero Stop works using the Job Limits feature Xerox introduced in EIP 2.0+. Each job is preauthorized with the PaperCut server which determines whether or not the job should
proceed based on the cost and the associated account balance. When initiating each job the
Xerox panel will show an “authorizing the job” message. If PaperCut does not authorize the
job, an error message is displayed and the job will not start.
Zero Stop is not supported for Fax or USB printing. Some early firmware versions do not
support Zero Stop for Scanning either. (See Section 5, Known Limitations and Security.)
A list of devices that support EIP can be found on the following web page (click on the “EIPcapable Hardware” tab section):
http://www.office.xerox.com/eip/enus.html
Examples of EIP 2.0+ capable devices are:




ColorQube 8700/8900
ColorQube 9301/9302/9303
WorkCentre 5735/5740/5745/5755/5765/5775/5790*
WorkCentre 7525/7530/7535/7545/7556
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights
Reserved.
6 of 50
| Xerox EIP 1.5+ Embedded Manual



2015-12-17
WorkCentre 7830/7835/7840/7845/7855
WorkCentre 58xx
WorkCentre 7220/7225
Examples of EIP 1.5 only capable devices:









Xerox Color 550/560
Xerox D95/D110/D125
ColorQube 9201/9202/9203
WorkCentre 5135/5150
WorkCentre 5325/5330/5335
WorkCentre 5632/5638/5645/5655/5665/5675/5687
WorkCentre 7120/7125
WorkCentre 7425/7428/7435
WorkCentre 7755/7765/7775
You can verify whether a particular MFP model supports Job Limits and is an EIP 2.0+ device
by the presence of a “Job Limits” configuration setting in the device web interface under
Accounting / Accounting Method.
To track the device usage the Xerox Network Accounting module must also be enabled
(Network Accounting is also known as JBA accounting). The “Network Accounting” module
is often included with the device, but for some devices it is necessary to have this enabled by
your Xerox supplier. Please contact your Xerox supplier for details.
NOTE: The FujiXerox devices available in the Asia-Pacific region do not support EIP. These
devices can instead make use of the Network Accounting features to control access to the
copier. See the PaperCut Xerox Network Accounting Embedded manual for information.
NOTE*: The 57xx series mentioned above may require some extra configuration and have
different workflow. One needs to enable “Display Custom Services Selection Button at the
local user interface” under Custom Service Setup. Otherwise one may see errors complaining
about being unable to set the default application. Also, when hitting the “Use Copier” button
from the Print Release page or the Account Selection page, the user will be returned to the
Custom Services page instead of the Home Services page. The user will need to hit the Home
Services page physical button on the copier instead.
1.1 Requirements
Ensure that the following points are checked off before getting started:



PaperCut is installed and running on your network. Please see the ‘Introduction ->
Quick Start Guide’ section of the PaperCut user manual for assistance.
Your Xerox MFD supports the Extensible Interface Platform version 1.5 or higher.
Your Xerox MFD has “Network Accounting” installed and enabled including off-box
authentication support. (Network accounting is also known as JBA accounting.) You
may need to contact Xerox to enable this functionality. Please check with Xerox
that the Network Accounting Kit license is still available because if the device has
been declared as "End of Life", it may no longer be available.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
7 of 50
| Xerox EIP 1.5+ Embedded Manual



2015-12-17
You have available the network name and IP address of the system running
PaperCut (e.g. the print server).
The Xerox MFD is connected to the network.
You have available the network address of the Xerox MFD. It is recommended that
the MFD is configured with a static IP.
2.2 Migrating from EIP 1.0 to EIP 1.5+ Xerox Devices
If you have an existing Xerox device that supports EIP 1.5+ and exists in PaperCut as an EIP
1.0 device, then you may want to convert this device into an EIP 1.5+ device in PaperCut.
Currently, there is no support for doing this directly in the PaperCut admin interface. You
could take screenshots of the device’s details tabs of: Summary, Advanced Charging and
Filters and Restrictions. Then delete the old EIP 1.0 device and create the new EIP 1.5+
device filling in the details based on your previous screenshots.
Please note that what was previously in PaperCut called an EIP 2.0+ device in the database is
equivalent to what we now call an EIP 1.5+ device (they are both stored in the same way in
the database unlike the EIP 1 device). Therefore, there is no need to convert from an EIP
2.0+ device to EIP 1.5+ because any previously defined EIP 2.0+ devices will now show up in
PaperCut as EIP 1.5+ devices.
An alternative more advanced method to do the conversion using a command line tool is to
change the device type in the PaperCut database. To do the conversion from EIP 1.0 to EIP
1.5+, you will need to do the following steps (where in this example the printer name to
change is called “device/XeroxPrinter” as you would see for the Device Name in the Device
List):
1.
2.
3.
4.
5.
Stop the PaperCut Application Server
Start a command prompt
On Mac/Linux, sudo su – papercut
cd [app-path]/server/bin/<platform>/
db-tools run-sql "update tbl_printer set device_type = 'EXT_XEROX_EIP2' where
device_type = 'EXT_XEROX_CAA' and display_name = 'device\XeroxPrinter'"
6. Start the PaperCut Application Server
7. Go to the Device details page and update the fields of:
a. Device’s administrator username
b. Device’s administrator password
The username and password from EIP 1 will have been set up for the SNMP v3
credentials which are not the same for EIP 1.5+. For example, typically for EIP 1 the
username will be set to “Xadmin” whereas in EIP 1.5+ it will be “admin”. NOTE: If
you take too long to set the correct credentials here then you could get locked out
of the MFP as PaperCut can continue to try connecting with the wrong credentials.
See the section FAQ & Troubleshooting on how to reset the lockout if this happens.
8. You might notice that in the Advanced Config tab that there are extra config
parameters that are not mentioned in this manual which are not used in EIP 1.5+
(that were used in EIP 1). They can safely be ignored.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
8 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
2.3 Card Reader support
PaperCut supports using swipe card for authentication at the copier. This is often more
convenient than entering username/password or ID/PIN numbers to log in.
Xerox devices can support 2 general classes of card readers:


Network card readers (i.e. not physically connected to the MFP. The PaperCut
server communicates with these over the network)
USB card readers directly connected to the Xerox device (some recent Xerox devices
with updated firmware now support a limited number of USB card readers – contact
Xerox for details).
The Network Card Reader option will work with any Xerox device supporting “Xerox Secure
Access”.
2.3.1 Network Card Readers
Network card readers may be used on any Xerox device. PaperCut supports two cost
effective network card readers:


Elatec TWN3 with the TCP Converter
RFIdeas Ethernet card readers
These readers are available directly from the card reader distributors and PaperCut
Authorized Solution Centers in your region.
These network card readers are located on the MFP device and are connected to the
network. When a user swipes their card at the reader the card number is sent to the
PaperCut server for validation. If the card number is valid the user will be granted access to
the MFP.
2.3.2 USB Card Readers
Xerox updated their platform in late 2011 to support USB card readers through Xerox Secure
Access. Devices supporting USB card readers include:






ColorQube 8700/8900 (firmware 071.160.222.26601 and above)
ColorQube 9301/9302/9303 (firmware 061.180.222.32100 and above)
WorkCentre 5890
WorkCentre 72xx
WorkCentre 75xx (firmware 061.121.222.21500 and above)
WorkCentre 78xx
The following card readers are supported by Xerox:



Proximity card readers – RFIdeas, Elatec TWN3, Elatec TWN4 (on some models)
Magstripe card readers – Magtek, “IDTech MiniMag”, RF Ideas MS3-00M1AKU
Barcode card readers - Honeywell (3800G04), Motorola (DS9208, DS457) – from
PaperCut 15.2
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
9 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
PaperCut should generally support the USB card reader if the particular Xerox Model and
firmware version support it. Up to date information on this compatibility can be obtained
from Xerox. The PaperCut software only interprets the XML data about the card reader that
is sent to it from the MFP (via Secure Access API) – if the card reader is not sending this
information then PaperCut can do nothing about reading the data and there must be an
issue or incompatibility between the Xerox MFP and the card reader.
2.4 Setup Procedure
2.4.1 Introduction
This procedure describes the process of setting up Xerox Secure Access EIP 1.5+ using the
Xerox ColorQube 8700 (EIP 2) as an example. This part of the setup is similar between the
EIP 1.5 and 2.0 devices. The specific steps, screen layouts and button/label names can differ
between device models. However the general process is the same for all supported devices.
2.4.2 Networking/Firewall Configuration
Ensure that your networking/firewall configuration allows:


inbound connections from the Xerox devices to the PaperCut server on ports 9191
and 9192.
outbound connections from the PaperCut server to the Xerox device on ports 80 and
443.
2.4.3 Enable the HTTPS/SSL protocol
Xerox Secure Access requires the use of HTTPS/SSL for communications. This must be
enabled before completing any of the subsequent steps.
This involves generating an SSL certificate for the device:
1. Login to the device’s web admin.
2. Navigate to Properties->Security->Machine Digital Certificate Management
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
10 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
3. Press "Create New Self Signed Certificate".
4. Complete the required information
5. Press Apply.
Now enable the HTTP/SSL/TLS protocol:
1. Navigate to Properties->Connectivity->Protocols->HTTP
2. Enable the "Secure HTTP (SSL)" option
3. Press Apply
2.4.4 Check SNMP version 2 Configuration
PaperCut uses SNMP v2 to configure the Xerox MFP. You must ensure that SNMP v2 is
enabled and that the SET community name matches the value of the advanced config key
“ext-device.xerox.snmpv2.set-community-name”. (The default value for this key is:
“private”.)
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
11 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
1. Login to the device’s web admin.
2. Navigate to Properties->Connectivity->SNMP
3. Edit the SNMP v1/v2c Properties
4. Verify the Community Names are correct and modify if required.
2.4.5 Create/setup the Xerox device in PaperCut
1. Log in to the PaperCut administration interface using a web browser (e.g.
http://papercut-server:9191/admin ).
2. Navigate to ‘Options -> Advanced’ and ensure the option ‘Enable external hardware
integration’ is enabled.
3. Press ‘Apply’.
4. Navigate to the ‘Devices’ tab.
5. Click “Create Device” action from the left.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
12 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
6. Select the "Xerox (Xerox Secure Access EIP 1.5+)" device type.
7.
8.
9.
10.
11.
Enter your own choice of a descriptive name for the device under “Device name”.
Enter the Xerox device’s IP address under “Hostname/IP”.
Optionally enter your own choice of location/department information.
Enter the device administrator username and password (e.g. “admin” and “1111”).
Under “Function” tick the options you would like to enable. E.g. “Track & control
copying”.
12. Click “OK”.
At this point PaperCut should try to connect to the device to configure various options over
SNMP and SOAP/HTTPS. The page displayed after the device is created displays the device
status. If there are problems communicating with the device then the status will show an
error message. Press the "Refresh" link next to the status to see if the status is updated.
2.4.6 Enable Xerox Secure Access (XSA) Authentication Settings
At this point the Xerox Secure Access can be enabled.
2.4.6.1 Enable XSA on ColorQube 8700 (EIP 2)
On some devices such as the 8700, XSA can be enabled this way:
1. Login to the device’s web admin.
2. Navigate to Properties->Login Methods->Web Service Enablement.
3. Click Edit.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
13 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
4. Enable the tick box for Xerox Secure Access.
2.4.6.2 Enable XSA settings on WorkCentre 5325 (EIP 1.5)
On some devices such as the 5325, XSA can be enabled this way:
1. Login to the device's web admin.
2. Navigate to Properties->Security->Authentication Configuration.
3. Ensure that the "Login Type" is set to "Xerox Secure Access"
4. Navigate to Properties->Security->Remote Authentication Servers->Xerox Secure
Access Settings
5. Enable "Local Login" and "Get Accounting Code".
2.4.6.3 Enable XSA on some other devices
1. Login to the device’s web admin.
2. Navigate to Properties->Security->Authentication Configuration.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
14 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
3. Select Next.
4. Change Device User Interface Authentication to Xerox Secure Access and press Next
5. Click on Configure for Device User Interface Authentication
2.4.7 Verify Xerox Secure Access (XSA) Authentication Settings
Once XSA is enabled ensure that the settings are correct.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
15 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
2.4.7.1 Verify XSA on ColorQube 8700 (EIP 2)
1. Navigate to Properties->Login Methods->Xerox Secure Access Setup.
6. Click on Manually Override Settings
7. Verify that the correct PaperCut Server IP Address is listed
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
16 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
8. Verify that the Login Methods is set to Xerox Secure Access + alternate on-screen
authentication.
9. Verify that it will automatically apply Accounting Codes from the server.
2.4.7.2 Verify XSA on WorkCentre 5325 (EIP 1.5)
This is difficult to do as there is not a corresponding "Properties" sub-menu in the admin
interface with all the settings of the Xerox Secure Access. However, a print out of the
Configuration Report does show the Xerox Secure Access Settings. This can be initiated from
the panel of the device. The relevant subsection is near the end of the report. Verify the
following settings:





Server name/address is the same as the PaperCut Application Server name/address
The port number is 9192.
The service path is of the format: "device/xerox-conv-auth/soap?deviceid=xxxx"
where xxxx is some number
Local Login is enabled.
Get Accounting Code is enabled.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
17 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
The report looks like:
Xerox Secure Access
Server Name / IP Address
"10.100.66.75"
Port Number
9192
Service Path
"device/xerox-conv-auth/soap?deviceId=5005"
Local Login
Enabled
Get Accounting Code
Enabled
2.4.8 Accounting Configuration on EIP 1.5 devices
For EIP 2.0 or later devices, the accounting configuration is performed for you by PaperCut,
whereas for EIP 1.5 devices, manual configuration in the device CWIS is required. Follow the
instructions in this section if you are installing an EIP 1.5 device.
One of the main Accounting settings required is to turn on the User and Accounting
prompts. The Prompts are used to ensure the user is tracked correctly in the Print Job Log
and also that the account is tracked correctly for EIP 1.5 (in EIP 2.0+, the account is tracked
by another method). Note that this setting is not used by PaperCut to prompt the user for
authentication despite its name.
2.4.8.1 Set the User and Account Prompts on WorkCentre 5325 (EIP 1.5)
1.
2.
3.
4.
5.
Login to the device’s web admin.
Navigate to Properties->Accounting->Accounting Configuration.
Ensure the "Accounting Type" is set to "Network Accounting".
Ensure all the Auditron Modes are enabled.
Ensure that the User Prompts are set to: "Display User ID & Account ID Prompts".
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
18 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
1. Navigate to Properties->Accounting->Accounting Login Screen Settings.
2. Ensure the Alternative Name for the User ID is set to "UserID"
3. Ensure the Alternative Name for the Account ID is set to "AccountID"
2.4.9 Ensure copier functions only accessed by logging in.
It is important to make sure that a user cannot access copier functions other than through
the XSA authentication methods.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
19 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
2.4.9.1 Access Control On ColorQube 8700 (EIP 2)
1. On some new devices, the Services Pathway can be found by navigating to:
Properties -> Login/Permissions/Accounting -> User Permissions -> User Permission
Roles -> Non-logged in Users -> Edit -> Services and Tools.
2. Ensure that non-logged in users cannot access the relevant services by setting to
"Not Allowed".
2.4.9.2 Access Control On WorkCentre 5325 (EIP 1.5)
1. Navigate to Properties->Security->Authentication Configuration.
2. Click on Next to go to "Step 2 of 2".
3. Navigate to the Device Access page.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
20 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
4. Change the Services Pathway setting to Locked. This locks access to the copier
functions unless the user is logged in.
5. Navigate to Properties->Security->Authentication Configuration.
6. Click on Next to go to "Step 2 of 2".
7. Navigate to the Services Access page.
Ensure all the services are locked including the "PaperCut Print Release" service.
Click apply when you are finished. You may be prompted to reboot for the settings
to take effect.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
21 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
2.4.9.3 Access Control On Other Devices
On other devices, it is done differently:
1. Navigate to Properties->Security->Authentication Configuration.
2. Navigate to the device access page.
3. Change the Services Pathway setting to Locked. This locks access to the copier
functions unless the user is logged in
NOTE: On newer devices the Pathway Options screen may look different such as the
screen below
You may need to reboot the device for the settings to take effect.
Once the device is rebooted the device should display a screen to log in. Perform testing and
verify you can log in and that copies are tracked by PaperCut.
2.4.10 Verify and Enable Extensible Interface Platform Settings
On some platforms such as the Xerox WorkCentre 75xx series and WorkCentre 5325, the EIP
settings may not be enabled by default. Please verify the settings and enable if necessary.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
22 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
1. Log in to the device’s web admin.
2. Navigate to Properties->General Setup->Extensible Service Setup
3. Verify that the Extensible Service Browser is enabled.
4. Click on the Extensible Service Registration Edit... button.
5. Verify that the Extensible Service Registration and User Interface Configuration
items are enabled.
2.4.11 (Optional) Enable network card reader
This section describes how to configure a network card reader for authentication at the
MFP. For more information on the supported card readers see Section 2.3 Card Reader
support.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
23 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
To enable the network card reader:
1. Log in to the PaperCut administration interface using a web browser (e.g.
http://papercut-server:9191/admin ).
2. On the “Devices” tab, select the MFP device.
3. Under the “Authentication Methods” option, enable the “Swipe Card”
authentication option.
4. Select the “Enable network card reader” option.
5. Enter the network address and the port of the network card reader.
6. Press “OK” or “Apply” to save the changes.
7. At this point PaperCut will establish the connection to the card reader. The status
of the connection to the network card reader is displayed below the settings. If
there is a problem connecting to the card reader any errors will be displayed here.
2.4.12 (Optional) Additional Network Security
The MFP communicates with the PaperCut server over the network (e.g. to authenticate
users or release print jobs). To provide an additional level of security, PaperCut may be
configured to only allow device connections from a restricted range of network addresses.
This ensures that only approved devices are connected to the PaperCut server.
By default PaperCut will allow device connections from any network address. To restrict this
to a subset of IP addresses or subnets:
1. Logon to the PaperCut administration web interface at http://<papercutserver>:9191/admin
2. Go to the OptionsAdvanced tab and find the “Security” section.
3. In the “Allowed device IP addresses” field enter a comma-separated list of device IP
addresses or subnets (in the format <ip-address>/<subnet-mask>).
4. Press the “Apply” button.
5. Test the devices to ensure they can continue to contact the PaperCut server.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
24 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
3 Post-install testing
After completing installation and basic configuration it is recommended to perform some
testing of the common usage scenarios. This important for two reasons:
1. To ensure that the embedded application is working as expected.
2. To familiarize yourself with the features and functionality of PaperCut and the
embedded application.
This section outlines four test scenarios that are applicable for most organizations. Please
complete all the test scenarios relevant for your site.
3.1 Test Preparation
To complete these tests it is recommended you use two test users so that each can be
configured differently. These users are:


‘testusersimple’ – used to perform basic copier monitoring and control and to
perform print release tests.
‘testuseradvanced’ – used to perform copier monitoring and control with the
account selection enabled (i.e. to charge copying to accounts/departments/costcenters/etc).
If you have existing users that can be used for these tests, then they can be used instead.
To setup these users in PaperCut:
1. Create the ‘testusersimple’ and ‘testuseradvanced’ users in your Active Directory or
LDAP directory.
2. Log into the PaperCut’s admin web interface
3. Go to the “Options->User/Group sync” page and press “Synchronize Now”.
4. Once the sync is complete, the users will be added to PaperCut.
The next step is to configure the users. To configure ‘testusersimple’:



In PaperCut, select the “Users” tab
Select the ‘testusersimple’ user.
Set the user’s balance to $50.00 and verify the account is set to “Restricted”.

Verify that this user is set to “Automatically charge to personal account” in the
“Account selection” options.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
25 of 50
| Xerox EIP 1.5+ Embedded Manual

2015-12-17
Press the “OK” button to save.
To configure ‘testuseradvanced’:
1. In PaperCut, select the “Users” tab
2. Select the ‘testuseradvanced’ user.
3. Change the “Account Selection” option to “Standard account selection popup” and
enable all the account selection options.
4. Press the “OK” button to save.
3.2 Scenario 1: Standard copying
Standard copying involves monitoring/charging printing to a user’s personal account. This is
most commonly used for student printing or basic staff monitoring. Users can also be
configured for unrestricted printing, which is commonly used for staff/employee use.
At the photocopier:
1. The photocopier should display a screen to prompt the user to login. Follow the
prompts to login.
2. When prompted, enter username (‘testusersimple’) and password in the login fields.
3. At this point the copier will be enabled for usage.
4. Follow the onscreen instructions and perform some test copying, i.e. press the
“Copy” key on the device and perform a copy as normal.
5. Once completed copying press the “Logout” button on the device’s keypad.
Back in the PaperCut application verify that the copier activity was recorded and the user’s
account deducted.
1. Log into PaperCut.
2. Select the device from the “Devices” tab.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
26 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
3. Select the “Job Log” tab. This will list all recent copying activity on the copier. The
copying just performed as the test user should be listed. Verify the details of the
copy job that was just performed.
4. Click on the user’s name in the user column to view the user’s account details
5. Select the “Job Log” tab to display all print/copy activity for the user.
6. Select the “Transaction History” tab and verify that the cost of the photocopying was
deducted from the user’s account.
3.3 Scenario 2: Copying with account selection
Firstly a test account should be created:
1.
2.
3.
4.
5.
Log into PaperCut, select the “Accounts” tab.
Select the “Create a new account…” action link on the left.
Enter an account name “Test Account 1”.
Enter PIN/Code “2233”.
Select the “Security” tab and allow all users to access that account by adding the
“[All Users]” group.
6. Press “OK”.
At the photocopier:
1. The photocopier should be displaying a screen to prompt the user to login. Follow
the prompts to login.
2. When prompted, enter the username, ‘testuseradvanced’, and the password in the
login fields.
3. You will now be presented with the Account Selection App:
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
27 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
You may select your account from a list, by search or by an account code/PIN. From
the list, select the “Test Account 1” created earlier.
4. At this point the copier will be enabled for usage. Follow the onscreen instructions
and perform some test copying. I.e. press the “Copy” key on the device and perform
a copy as normal.
5. Once completed copying press “Logout” button.
Note: The account selection workflow can vary according to the user options selected. For
example a user configured to see the Advanced Account Selection popup may see an
additional dialog asking for command and invoice information. At the device level, you may
also configure whether you wish to see the Account Summary screen or not.
3.3.1 Verify Account Tracking in PaperCut
Back in the PaperCut application verify that the copier activity was recorded and the user’s
account deducted.
1. Log into PaperCut
2. Select the device from the “Devices” tab
3. Select the “Job Log” tab. This will list all recent copying activity on the copier. The
copying just performed as the test user should be listed.
4. Verify the details of the job (i.e. that the job was charged to the selected account).
5. In the log details, click on the “Charged To” account name to view the account’s
details.
6. Selecting the “Job Log” tab will display all print/copy activity for the account, and
will show the test photocopying that was performed.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
28 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
3.4 Scenario 3: Print release
The embedded application may also be used for print release. For a full description of
PaperCut hold/release queues and release stations, please read the PaperCut manual.
Skip this scenario if hold/release queues will not be used at your site.
To perform print release testing, a hold/release queue must be enabled:
1. In PaperCut, select the “Printers” tab.
2. Select the print queue (i.e. not the ‘device’) for the Xerox MFD that will be used for
testing.
3. Enable the “Hold/release queue” option.
4. Press OK/Apply to save the changes. All printing to this queue will now be held until
released by a user.
The photocopier device must also be enabled as a “Print Release Station”:
1.
2.
3.
4.
In PaperCut, select the “Devices” tab.
Select the Xerox MFD device.
Under “Device Function” tick “Enable release station”.
Select the print queue that was enabled for hold/release above. The Xerox device
will allow jobs on the selected queues to be released.
5. Press “OK” to save.
6. Login to a computer workstation as ‘testusersimple’.
7. Print a few jobs to the print queue that was configured above. The jobs will be held
in the hold/release queue.
8. Confirm that the jobs are held, by checking that the jobs are listed in the “Printers ->
Jobs Pending Release” page of the PaperCut administration interface.
9. Confirm that the username is ‘testusersimple’.
At the device:
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
29 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
1. Log into the device as “testusersimple” as described above.
2. Upon successful login you will be presented with the Print Release dialog:
3. Select “Print All” to release all jobs. The jobs will begin to print to the destination
printer. (The “Print All” button will not appear if there are no jobs to print)
4. Once completed press the “Logout” button on the device keypad.
3.5 Scenario 4: Scanning and faxing
Xerox devices can also scan documents and send them by email. If a phone line is attached,
they can send faxes. You can enable tracking scanning and faxing. Users can be prevented
from scanning or faxing when they are out of credit.
To enable tracking of scans and faxes:
1. In PaperCut, select the “Devices” tab.
2. Select the MFD device.
3. Under “Device function” tick “Track & control scanning” and tick “Track & control
faxes”.
4. Select the charging type “advanced” in both cases and set some numbers for page
costs and thresholds. The cost after the threshold should be lower than the standard
cost as it represents a volume discount. As an example, the screen shot below shows
that the first page of a fax is charged at $0.20 and any subsequent page at $0.10.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
30 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
At the photocopier, log in and scan a few documents and send a few faxes. At the end, make
sure to press the “Logout” button on the device’s keypad.
In the PaperCut administration interface verify that the scan and fax activities were recorded
and the user’s account was deducted. This can be done as follows:
1. Log in to the PaperCut administration interface.
2. Select the device from the “Devices” tab.
3. Select the “Job Log” tab. This will list all recent activity on the copier, including
copying, scanning and faxing. The jobs just performed as the test user should be
listed. Verify the details of the jobs that were just performed.
4. Click on the user’s name in the user column to view the user’s account details.
5. Select the “Job log” tab to display all activity for the user.
6. Select the “Transaction History” tab and verify that the cost of the scans and faxes
was deducted from the user’s account.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
31 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
4 Configuration
After completing the Installation section and registering the device with PaperCut, it will have been
configured with reasonable default settings that are suitable for most environments. This section
covers how to change those default settings. All the following settings are available via the device’s
‘Summary’ tab in the PaperCut administration interface.
4.1 Device Function
The device function setting defines which functions will be available on the device and how it will be
used. Not all function settings are supported on all devices.
Each device function is discussed in the following table.
Device Function
Description
Track & control copying
The device will track walk-up off-the-glass copying.
Track & control scanning
The device will track scanning such as scan-to-email or scan-to-file.
Track & control faxing
The device will track the sending of faxes.
Enable release station
The device will act as a print release station.
4.2 Authentication Methods
PaperCut supports a number of different ways to authenticate users who walk-up to the devices to
perform copying. The default authentication method is username and password authentication.
The available authentication methods can be modified in the ‘External Device Settings ->
Authentication methods’ section.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
32 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
Authentication methods available for a device
Not all authentication methods are supported on all devices. A grayed-out option indicates that the
option is not supported on this device.
Each authentication method is discussed in the following table.
Authentication
Method
Description
Username and password
The user may use their domain/network username and password to
log into the device.
Identity number
The user may log in with their identity number. Identity numbers are
convenient when usernames are long or cumbersome to enter. For
example, rather than entering a username like ‘john.smith.001’, it may
be more convenient to enter an employee ID of ‘1234’. See the
PaperCut user manual for information about user identity numbers,
including importing identity numbers from an external source.
Identity number ->
Require PIN
When a user logs in with their identity number, they must also provide
their associated PIN. This provides additional security for identity
number logins.
Automatically login as
user
Specifies that this device should always automatically log in as the
given user. This option overrides all other authentication methods
Description of authentication methods
4.3 Configuring Swipe Card Readers
Swipe cards contain numbers which are used to identify users according to the card number
configured in the User Details screen under “Card/Identity” number. Some readers report
information in addition to the number encoded on the card, such as checksums. PaperCut can treat
these cases in two ways:
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
33 of 50
| Xerox EIP 1.5+ Embedded Manual


2015-12-17
A typical case is the checksum being reported after the card number, separated by an equals
sign, such as in 5235092385=8. PaperCut can handle this case by default; it will extract the
number before the equal sign as the card number: 5235092385.
For some cases, a “regular expression” may be required that will filter the card number from
the complete string of characters reported by the card reader. Documentation on regular
expressions can be found on the Internet, e.g. at www.regular-expressions.info.
o The regular expression must be fashioned so that the card number is returned as the
first match group.
o Usually one regular expression will be used for all the devices managed by PaperCut;
this must be entered in the “Config editor (advanced)” which you will find on the
Options tab under Actions. The key is called “ext-device.card-no-regex”.
o The global setting however can be overridden on a per-device basis: The key “extdevice.card-no-regex” can also be found on the “Advanced Config” tab in the device
details screen. This setting will override the global setting unless the keyword
“GLOBAL” is specified.
o PaperCut developers will gladly assist in producing a regular expression when
supplied with a few sample outputs from your card reader. Please contact PaperCut
support.
o If you would like to write your own regular expressions, here are some examples:
 Use the first 10 characters (any character): (.{10})
 Use the first 19 digits: (\d{19})
 Extract the digits from between the two “=” characters in
“123453=292929=1221”: \d*=(\d*)=\d*
4.4 Single Sign On (SSO)
No further configuration is required as PaperCut passes all the known information about the logged
in user to the MFP at the time of login such as the Full Name, email address, and more. This
information can then be used by other components on the MFP (or possibly other 3rd party
applications).
One example is that when you use the scanner functionality, the MFP can use your email address,
provided by PaperCut, to simplify scan-to-me style work-flows.
4.5 Customizing the Header Logo
The embedded application displays a logo in the top right corner. This logo can be replaced with
your organization’s own logo image.
The image must be saved as a PNG file with the filename “logo.png” and be 231 pixels wide and 52
pixels high.
Save the image on the PaperCut application server in the location:
[PaperCut Install Location]\server\custom\web\device\xerox\eip2\
You will need to create these folders if not present.
The embedded application will fetch the logo image from this location if it is present. After copying
your logo into position, verify it correctly appears in the embedded application.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
34 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
5 Known Limitations and Security
The Xerox environment has a number of limitations that have impacted on functionality and
security. The limitations will be different for EIP 1.5 devices than for EIP 2.0+.
5.1 EIP 1.5 device limitations summary
EIP 1.5 devices do not have the Job Limits feature (unlike EIP 2.0+ devices), and this will affect the
following:

There is no zero stop capability.
If the EIP 1.5 device is using the Account Selection App (which it will by default):


It cannot force a user to choose a shared account
It cannot stop a user from logging in without sufficient balance (if they can choose an
account) because we don't know what account they will choose at login time
If the EIP 1.5 device is not using the Account Selection App (by setting ext-device.xerox.selectaccount to "N" or if the account selection options for users don't allow the user to select an
account):


we can stop the user from logging into the device without sufficient balance
BUT we then cannot allow free scanning or free faxing in this case
5.2 No Zero Stop for EIP 1.5 devices
Xerox EIP 1.5 devices (e.g. Xerox 5325) do not support Zero Stop and the ability to stop a job part
way through because of insufficient funds. However, if after the job is completed and retrieved from
the MFP and the user is out of credit, the user will be logged off the device.
5.3 Account selection limitation and login without credit limitation
for EIP 1.5 devices
By default, on an EIP 1.5 device it cannot force a user to select an account because it does not have
the Job Limits feature to support this. Therefore, if you need to force the user to select an account
on an EIP 1.5 device then you will need to set ext-device.xerox.select-account to "N" which will no
longer use the Account Selection app to select an account. Instead, the user interface of the Secure
Access login workflow will be used for the user to input an account.
Because, we cannot guarantee an account is selected, if the user has the ability to choose a shared
account then we cannot know at login time whether they have enough balance or not. For example,
the user may have $0 in their personal account but there is $20 in the Science account that they
have access to. So at login time, when an account selection app is used, we cannot fairly stop the
user from logging in. If you need to guarantee that a user cannot login without enough balance then
you either need to set ext-device.xerox.select-account to "N" or change the account selection
options so that the user cannot select a shared account.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
35 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
5.4 Cannot have free scanning/faxing and stop users from logging
in with insufficient balance on EIP 1.5 devices.
Without the Job Limits feature, we have no way of knowing ahead of time what service the user is
going to pick and we cannot stop them once they have logged in and are at the home screen.
Therefore, to do a balance check we assume that the user is able to do a 1 page copy job and we will
prevent the user logging in if they don't have enough balance to do so. This will then stop them even
if they weren't going to do a copy job but instead were going to do a scan or fax job.
However, one option is to set up the MFP such that the Scanning service does not require any
authentication and it can effectively bypass PaperCut. For example, on a Xerox 5325 (EIP 1.5), the
following 2 settings can be done:
5.4.1 Disable the Job Accounting for scanning
1. Log in as the admin user.
2. Go to the Properties->Accounting->Accounting Configuration
3. Enable the Auditron Mode for the service that you want authentication on e.g. see attached
screen shot which enables the Copy service but not the scanning services.
5.4.2 In Secure Access, turn off authentication for scanning
1.
2.
3.
4.
Login as the admin user
Go to Properties->Security->Authentication Configuration
Click Next
Click "Configure…" on Service Access
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
36 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
5. Lock the services that you need authentication on and unlock the other services. For
example, leave the scanning services unlocked.
5.5 No Tracking or Zero Stop for USB Printing
As Xerox does not provide a way for PaperCut to distinguish between print jobs initiated at the
copier and print jobs initiated at the client’s workstation, we are currently unable to track USB
printing.
This same limitation also means that Zero Stop for USB printing is not supported.
5.6 No Zero Stop for Faxing
Xerox devices currently do not stop fax jobs when users run out of credit. Instead, users can
complete the fax job and possibly incur an overdraft in their accounts (if Fax Tracking is supported
for that model).
5.7 Fax Tracking
Many Xerox MFPs do not log sent faxes in the Network Accounting / JBA logs. On these devices
PaperCut cannot track any outbound faxes.
Please check with Xerox whether your device model supports fax tracking via Network Accounting.
For example, the following Xerox devices do not support tracking faxes:
6.
7.
8.
9.
ColorQube 8700
ColorQube 8900
WorkCentre 5735/5740/5745/5755
WorkCentre 5765/5775/5790
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
37 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
10. WorkCentre 7525/7530/7535/7545/7556
5.8 User Interface
The interface displayed during the user login process has some limitations. For EIP 1.5 devices, this
is also used to select an account. The Xerox Secure Access features allow us to display any number of
screens with either one of the following features:
1. A text input field (which can be optionally masked for password input)
2. A prompt with “Yes” and “No” buttons.
These limitations restrict the richness and flexibility that we can provide in the login process.
This is a limitation of the Xerox Secure Access system.
5.9 Bypassing the System
It is important that the administrators take care to prevent users from bypassing the system and
directly accessing the copier.
To ensure the system is secure, administrators should take the following precautions:


The copier’s built in admin password should be changed from the default and always kept
secure.
The services should be locked down as specified in section 2.4.9.
5.10 Card Reader support for authentication
PaperCut supports network card readers using common card formats. For more information,
contact the PaperCut Authorized Solution Center in your region.
The Xerox Secure Access environment began supporting USB card readers in late 2011. Support for
USB card readers is only available on some MFP devices with the latest firmware and Xerox is
gradually rolling out support for USB card readers across their device range. Contact Xerox for
information on what devices and firmware are required for USB card reader support.
5.11 Job Assembly not supported by default on EIP 2.0+
Xerox’s Job Assembly feature which allows one to program a job with different attributes such as
different page sizes, is not supported if Job Limits is used. Job Limits is currently used by PaperCut
for Zero Stop and potentially forcing Account Selection on EIP 2.0+ devices – it is not used on EIP 1.5
devices. If you require Job Assembly and do not require Zero Stop or enforcement of Account
Selection, then you need PaperCut to disable the Job Limits’ preauthorizations on the Xerox MFP.
Once this is done, the Job Assembly buttons will be enabled and the functionality should work.
If you do need to force the user to select an account then you can set ext-device.xerox.selectaccount to "N". Account Selection will then be done during the login workflow instead of by using
the Account Selection App. Note that account selection done in this manner is not as user friendly.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
38 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
5.11.1 Turning Off Job Limits’ Preauthorization
You need to do the following to disable the job limits from pre-authorizing jobs.
1. Log into PaperCut.
2. Navigate to the Xerox device’s details page.
3. Navigate to the Advanced Config and set ext-device.xerox.enable-preauth to “N” and click on
the Update button. This configuration change will modify the Xerox device in a few seconds.
5.11.1.1
Check Preauthorization is disabled on Xerox MFP (optional)
Optionally, if you want to make sure that the previous configuration setting has happened, then you
can check on the Xerox’ admin pages.
1. Login to the device’s web admin (CWIS).
2. Navigate to Properties->Login/Permissions/Accounting->Accounting Method
3. Click on the Edit button for Accounting Workflow
4. Verify that for all the job types that the Accounting Workflow is just set to “Capture Usage”.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
39 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
5.12 Unable to bypass authentication for custom Apps/Services
It is possible to decide whether a non-logged-in user is allowed to access a service or not. This can be
set in the CWIS via Properties->Login/Permissions/Accounting->User Permissions->Services & Tools.
Potentially, it can allow one to access a service without requiring authentication which may be useful
in some circumstances. An example, might be allowing Xerox's Mobile Print App to be selected
without requiring initial authentication. However, if one "allows" an additional App to be used
without logging in, then it will pop up an Accounting dialog which requests a User ID and an Account
which makes no sense to the user and we do not want. This is triggered by having the User
Accounting Prompts enabled for services.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
40 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
The User Accounting Prompts are needed for Xerox's Job Limits feature which allows PaperCut to do
Zero Stop and tracking of Shared Accounts. The prompts are also used for tracking usernames in the
job log. Therefore, the User Accounting Prompts are essential to PaperCut's solution for Xerox which
means we are unable to support the custom Apps without them being set to require authentication.
5.13 Less automatic configuration on EIP 1.5 devices
The following configuration is set on EIP 2.0+ devices but may not be set on EIP 1.5 devices and
should be set manually in the admin interface of the device (CWIS):



Job Accounting's User and Account Prompts
Secure Access Setting of "Local login"
Secure Access Setting of "Get accounting code from server"
6 Advanced Configuration
6.1 Config Editor
The common configuration options for a device in PaperCut are available on the device’s ‘Summary’
tab, and are discussed in more detail in the Configuration section. This section covers the more
advanced or less common configuration options which are available via the ‘Advanced Config’ tab.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
41 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
Config name
Description
ext-device.card-selfassociation.usesecondary-card-number
Select whether user self-association should occupy the primary or
secondary card number. It overrides the global setting unless the keyword
"GLOBAL" is specified. This is useful when there is a mix of different nonconfigurable card readers that read different numbers from an ID card.
Set to "Y" to use the secondary card number, "N" to use the primary card
number. Default: "GLOBAL" to defer to the global configuration option.
ext-device.xerox.logininstruction
Defines the text to display on the initial login screen displayed by the
Xerox device. If set to “DEFAULT” PaperCut will set this message based
on the authentication settings of the device.
IMPORTANT: The Xerox device has very limited support for non-ASCII
characters. If you have problems please only use ASCII characters.
ext-device.xerox.jobdownload-after-loginperiod-secs
The number of seconds between PaperCut downloading/polling the
device job logs after the user is logged in. The default for this is every 10
seconds. The minimum this can be set to is 5 seconds.
Default: DEFAULT (which allows PaperCut to choose the most
appropriate time – usually 10 seconds).
ext-device.xerox.authuser-prefix
When user’s login to the Xerox their credentials like username (and
password if provided) are passed to the Xerox device by PaperCut. This
allows the device to use these credentials for other authentication. E.g.
To authenticate the use when using the “Scan to Home” features.
In some environments, the username must be prefixed with the windows
domain for this to work properly. This setting allows the domain to be
prefixed to the username so that the user does not need to enter it
manually.
For example, if this setting is set to: “DOMAIN\” and the user named
“john” logs in, PaperCut will pass the username “DOMAIN\john” to the
Xerox.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
42 of 50
| Xerox EIP 1.5+ Embedded Manual
extdevice.xerox.card.magst
ripe-track-no
2015-12-17
When a USB Magstripe card reader is used, the card data can be found on
one of 3 tracks. Typically the track of interest is track number 2. This
configuration parameter specifies a comma separated list of track
numbers to look at in order to retrieve the card data. For example if the
list was: 2, 3 then it would look to see if there was data for track 2 and if
there wasn’t then it would look to see if there was data for track 3. If it
can’t find any valid track data, then it will show an error message on the
Xerox Panel and a more detailed message in the logs. Note: Prior to
PaperCut 13.4, this list can only contain one value.
Default: 2 (by default only look at the data associated with track 2)
ext-device.xerox.localeoverride
Specify a two letter language code to force the language setting for use on
the device.
The locale is determined by the following priority sequence:
ext-device.xerox.initialaccount-tab
1.
ext-device.xerox.local-override setting
2.
The language set on the Xerox device
3.
The locale set on the PaperCut server (system.default-locale
config key)
4.
The default locale configured on the operating system running
the PaperCut server
Specify the name of the default tab to show on the Account Selection
dialog.
Specify “list”, “search” or “code”. Default: “list”
ext-device.xerox.showrelease-on-login
Specify whether to include the Print Release dialog in the login workflow,
if the device is configured as a release station. Values: Y, N. Default: Y
If set to N, the user must press the “Print Release” button on the Services
Home panel to access the release application to release jobs.
extdevice.xerox.releaseshow-cost
Specify whether to show the Job cost for each print job. Values: Y, N.
Default: Y.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
43 of 50
| Xerox EIP 1.5+ Embedded Manual
ext-device.xerox.selectaccount
2015-12-17
Specify whether to support the Account Selection app on the MFP and
display of the Account Selection Page. Values: Y, N. Default: Y
If set to N, the Account Selection App will not be registered on the MFP
and therefore no Account Selection icon will be shown on the panel.
Instead, account selection will be done during the Secure Access login
workflow. A reason to set this to N is to be able to force the user to
choose an account in the cases of EIP 1.5 devices or EIP 2.0+ devices that
want to use the Job Assembly feature.
ext-device.xerox.selectaccount-on-login
Specify whether to include the Account Selection dialogs in the login
workflow. Values: Y, N. Default: Y.
If set to N, the user must press the “Account Select” button on the
Services Home panel to access the account select application to select an
account.
extdevice.xerox.requireaccount-selection
Specify whether to always stop the user performing a copier job until they
select an account in the Account Selection dialog. Values: Y, N. Default: N.
If set to N, then it will only force account selection if the user is not
allowed to charge to their personal account and they haven’t chosen an
account yet.
If set to Y, then the user must choose an account otherwise they won’t be
able to perform a job.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
44 of 50
| Xerox EIP 1.5+ Embedded Manual
ext-device.xerox.enablepreauth
2015-12-17
Relevant to EIP 2.0+ devices only.
Specify whether PaperCut should enable or disable the Accounting
Workflow preauthorization on the device for the different types of jobs.
This is required for Zero Stop to work.
Values: Y, N. Default: Y.
If set to N, then it will change the preauthorization from “Preauthorization and Capture Usage” to “Capture Usage”. This can be done
so that the Job Assembly feature is enabled on Xerox. Zero Stop will not
work and the Account Selection app will no longer be available.
extdevice.xerox.configurepreauth-and-prompts
Relevant to EIP 2.0+ devices only.
Specify whether PaperCut should configure the Accounting Workflow and
Prompts on the device for full PaperCut functionality. Values: Y, N.
Default: Y.
If set to N – it is your responsibility to configure the MFP Accounting
Workflow and User Accounting Prompts to suit your needs. Note that
normal PaperCut job control may not work as expected. In particular,
Zero Stop may not work and the Account Selection app will no longer be
available (account selection via Secure Access workflow will be enabled
instead).
ext.device.xerox.swipeto-logout
Specify whether swiping a card when a user is logged in will log them out
or be ignored.
Values: Y, N. Default: Y.
If set to N, then when a user is logged in and they swipe their card, they
will no longer be logged out and the swipe will be ignored.
extdevice.xerox.releaseapp-label
Overrides the text to display for the label of the Print Release application
icon.
Default: DEFAULT (PaperCut will set this label using the default localized
Print Release string).
6.2 Setting an explicit PaperCut Server Network Address
The copier connects to the PaperCut server to validate user credentials, display print jobs for
release, etc. The device makes inbound network connections to the PaperCut server using the
network address of the PaperCut server. By default PaperCut will use the server’s IP address (if the
server has multiple IPs (i.e. multi-homed) then PaperCut will select one of them), but on some
networks this address may not be publicly accessible from other parts of the network.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
45 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
If the PaperCut server has a “public” IP address or DNS name then this can be used instead, which
allows the copiers to use the “public” network address instead of the IP address that PaperCut
detects. To do this:






Log into PaperCut
Go to the "Options" tab.
Select "Config Editor (advanced)", from the action links on the left.
Find the "system.network-address" setting.
Enter the public network address for the PaperCut server.
Press the "Update" button next to the setting and confirm the setting is updated.
When connecting devices to a PaperCut site server, you can configure the sites’ “Network address
used by devices”:





Login to PaperCut
Go to the “Sites” tab.
Select the site to edit.
Change the “Network address used by devices”.
Save the site details.
To have either of these changes take effect immediately, restart the PaperCut Application Server
service (i.e. on Windows use: Control Panel->Admin Tools->Services).
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
46 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
7 How it works
The following section gives a brief overview of the internal workings of PaperCut’s on-board solution
for Xerox devices. It’s provided as background information and may be useful for technical
administrators in troubleshooting problems.
Typical function workflow:
1. A user logs into the MFP via the panel. The MFP is configured to contact PaperCut (via SOAP
web services) to verify login information.
2. The user ID and password is validated and device access is granted as appropriate.
3. If “release jobs on login” is enabled, any waiting jobs are immediately queued for printing.
(called secure print release or find-me printing)
4. If the user performs any device functions such as Copy, Fax or Scan, these are recorded
against the user ID in the device’s onboard logs.
5. On EIP 2.0+ devices, if PaperCut is tracking a device function, then at the start of the job it
will send a SOAP message to PaperCut asking authorization to print the job or not. PaperCut
will look at the attributes of the job and decide if the charging account has enough money to
pay for the job. If it does then the job will proceed, otherwise an error message will be
displayed. This is how the Zero Stop functionality works.
6. At regular periods (e.g. every minute) PaperCut contacts the device looking for new log
entries (logs are downloaded via HTTP using JBA network accounting).
7. Any new log entries are analyzed and recorded in PaperCut’s usage database. Any cost
associated with the usage is charged from the user’s account (or their selected Shared
Account).
8 FAQ & Troubleshooting
PaperCut shows an error status for the device. What could cause this?
In the “Devices” list the Xerox device may appear with an error status (hover your mouse over the
status to see the full status message). The status message will help understand the cause of the
error. The most common cause of problems is due to a networking issue, to resolve:





Verify that the device network address (or IP) is entered correctly in PaperCut
Verify that networking and firewalls allow PaperCut to establish a connection to the device
on TCP ports 80 and 443 and UDP port 161 for SNMP.
Verify that the configured SNMP SET community name matches the advanced config key:
“ext-device.xerox.snmpv2.set-community-name” (the default value is “private”).
Verify that networking and firewall settings allow the device to establish connections to the
PaperCut server on ports 9191 and 9192.
Verify that you have provided the correct administrator login credentials for the device in
the PaperCut device configuration page.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
47 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
Another common cause of errors is that “Network Accounting / JBA” has not been
enabled/configured on the device. Ensure that the Network Accounting is enabled as described in
section 2.4.6.
Another possible cause of problems is if the device firmware does not support the “Off-box
validation” features required by PaperCut. This feature should be available for recent Xerox copiers
supporting “Network Accounting”, however sometimes a firmware upgrade is required.
How often does PaperCut poll for accounts?
Account validation is done in real-time using the Xerox authentication web services methods. Hence
any changes made to Shared Accounts, user rights, or user passwords are available immediately.
How often does PaperCut poll for job activity?
After PaperCut detects a login it will check for the completion of the job(s) every 2 minutes. Hence
on average the job will appear in, and be charged by, PaperCut on average no longer than a minute
after the job completes and the user logs out of the copier.
During no activity, the copier status is checked every 5 minutes.
Can I use a hostname rather than an IP address in the URLs when configuring the release station
settings?
Using a hostname relies on the MFD using your DNS and ensuring that your DNS is correctly
configured. The quickest failsafe option is to use the server’s IP. If you have advanced networking
skills, you may wish to investigate using a hostname.
The device displays an error when authenticating the user.
The most likely cause of problems is that the device cannot establish a connection to the PaperCut
server. Make sure that your networking/firewalls allow network connections from the device to the
PaperCut server on ports 9191 and 9192.
Also ensure that the device SSL/HTTPS options are enabled. Ensure that the option to “Verify the
remote server certificate” is disabled.
If your PaperCut server has multiple IP addresses or you use NAT on your network, see section 6.2
on how to explicitly configure the PaperCut server’s network address.
On some EIP 1.5 devices (such as WorkCentre 5325), the device may need to be rebooted for it to
properly register the Secure Access URL to use.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
48 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
I see an error on the Xerox LCD screen?
This may indicate networking issue, a configuration issue, or maybe a software bug. Re-check your
settings and restart the MFD (i.e. power off and power on the copier). If problems continue, contact
PaperCut Support.
The PaperCut device status reports the following error:
Error: User authentication failed IPLockedOut: Excessive Failure Attempts
This error can occur if you have the incorrect username and password set up for the PaperCut
device. Even if you then set the correct username and password you can be locked out for a while.
To reset the lockout, you can go to the following page:
http://device-address/diagnostics/ipLockout.php
The “Build Job” and “Sample Job” buttons are greyed out. What is wrong?
This should only be an issue on EIP 2.0+ devices and not on EIP 1.5 devices. The Job Assembly
feature of the Xerox, unfortunately, is not compatible with Job Limits and therefore the Job
Assembly buttons are disabled by default. If you need this functionality and don’t need Zero Stop,
then see section 5.11.
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
49 of 50
| Xerox EIP 1.5+ Embedded Manual
2015-12-17
Some accented characters do not appear correctly on the MFP panel on some devices. How can we
display these characters?
On some Xerox devices, such as the WC 75xx models, we have seen issues with accented characters
such as French and Norwegian.
Change the settings below on the device's web page (CWIS):
1. Properties  General Setup  Internationalization  Selected Locale = Custom
2. Properties  General Setup  Internationalization  Encoding Priority for "UTF-8" to be
1st Priority
3. Reboot the MFP after changed that setting
Copyright © 2015 PaperCut Software International Pty. Ltd., All Rights Reserved.
50 of 50
Was this manual useful for you? yes no
Thank you for your participation!

* Your assessment is very important for improving the work of artificial intelligence, which forms the content of this project

Download PDF

advertisement