.. /* * This file is part of the SavaPage project . * Copyright (c) 2026 Datraverse B.V. * Author: Rijk Ravestein. * * SPDX-FileCopyrightText: (c) 2020 Datraverse B.V. * SPDX-License-Identifier: CC-BY-SA-4.0 * * For more information, please contact Datraverse B.V. at this * address: info@datraverse.com */ .. _ch-auth-print: .. figure:: ../images/manual/savapage-logo-no-text-100px.png :width: 75px Authenticated Printing ====================== .. admonition:: |ADMONITION_TABLE_OF_CONTENTS| - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` - :numref:`{number}. {name} ` Authentication in a printing environment is the act of confirming the digital identity of the person who issued a print job. Knowledge of this identity is crucial for SavaPage to securely offer its services to the right user. The next sections discuss authenticated printing. But first, let us introduce the key authentication concepts where our discussion is based upon. .. _ch-auth-print-key-concepts: Key Concepts ------------ .. contents:: :depth: 1 :local: This section lists the main authentication concepts headed with a short *term*. Each term is defined with a concise description, optionally followed with more details and a list of invariants. .. _ch-auth-print-key-concepts-user: User ~~~~ *An actor with a unique identity.* .. _ch-auth-print-key-concepts-person: Person ~~~~~~ *A* :ref:`User ` *who represents a real human being, as opposed to an abstract human role, software service or hardware device.* - Only Persons can login to |PRODUCT_NAME|. - Any User can print to a SavaPage Printer. However, |PRODUCT_NAME| assigns a print job to a Person. .. _ch-auth-print-key-concepts-domain-user: Domain User ~~~~~~~~~~~ *A* :ref:`User ` *defined in an* :ref:`SSO domain `. .. _ch-auth-print-key-concepts-synced-user: Synchronized User ~~~~~~~~~~~~~~~~~ *A SavaPage* :ref:`User ` *synchronized from a* :ref:`User Source `. - |PRODUCT_NAME| assumes each Synchronized User is a :ref:`Person `, but Administrators can mark a user as :ref:`Abstract `. .. _ch-auth-print-key-concepts-synced-person: Synchronized Person ~~~~~~~~~~~~~~~~~~~ *A Synchronized User that is a* :ref:`Person `. .. _ch-auth-print-key-concepts-internal-person: Internal Person ~~~~~~~~~~~~~~~ *A* :ref:`Person ` *who is* :ref:`internally defined ` *in SavaPage , opposed to a* :ref:`Synchronized Person `. .. _ch-auth-print-key-concepts-auth-user: Authenticated User ~~~~~~~~~~~~~~~~~~ *A* :ref:`User ` *authenticated on a* :ref:`SSO domain ` *by a workstation login.* .. _ch-auth-print-key-concepts-auth-abstract-user: Authenticated Abstract User ~~~~~~~~~~~~~~~~~~~~~~~~~~~ *An* :ref:`Abstract User ` *authenticated on a* :ref:`SSO domain ` *by a workstation login.* - Before Authenticated Abstract Users can print to a |PRODUCT_NAME| Printer they need to login to the SavaPage Web App on the same device from which they use the printer. .. _ch-auth-print-key-concepts-auth-person: Authenticated Person ~~~~~~~~~~~~~~~~~~~~ *A* :ref:`Synchronized Person ` *authenticated on a* :ref:`SSO domain ` *by a workstation login.* - Authenticated Persons can print to |PRODUCT_NAME| without being logged in to the Web App. .. _ch-auth-print-key-concepts-trusted-queue: Trusted SavaPage Queue ~~~~~~~~~~~~~~~~~~~~~~~~~~ *A SavaPage Print* :ref:`Queue ` *whose print jobs are trusted to originate from Authenticated Users.* - Each SavaPage Print Queue is untrusted by default. However, administrators can mark SavaPage Print Queues as *trusted* by setting its Authentication to None. - Every job of a trusted SavaPage Queue is checked for the originating User. When this user is an :ref:`Abstract User `, |PRODUCT_NAME| uses :ref:`IP Based Authentication ` to deduce the associated :ref:`Person `. If the Person cannot be deduced the job is ignored. - Note that the “trust” qualification is SavaPage internal use only, and not related to network domain trust in any way. - SavaPage Print Queues are IPP based and, from a network point of view, are publicly accessible by nature. - SavaPage does not bet on native domain trust alone, and accepts public network access as a given fact. But even in this case, SavaPage Print Queues can still be *internally* trusted if access is limited to authorized users on a network level. Stated the other way round: administrators need to prevent that users who connect to the network unauthenticated, e.g. with their personal laptop, use Trusted SavaPage Queues. SavaPage adds a helping hand here with an option to restrict print queue usage to a specific range of IP addresses. This makes it possible for instance to deny trusted queue access for wireless users who get their IP addresses from a distinct DHCP server issuing leases from a distinct IP range. .. caution:: When non-domain users are allowed to print to trusted |PRODUCT_NAME| Printers an accidental match with a :ref:`Synchronized Person ` may lead to undesirable results. .. _ch-auth-print-key-concepts-public-queue: Public SavaPage Queue ~~~~~~~~~~~~~~~~~~~~~ *A SavaPage Print Queue where print jobs are not trusted to originate from* :ref:`Authenticated Users `. - A public queue must be explicitly marked for |RST_BUTTON_STANDARD| or |RST_BUTTON_BASIC| Authentication in the SavaPage :ref:`Admin Web App `. .. _ch-auth-ip-based: Standard IP Based Authentication ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ *Deduction of the printing* :ref:`Person ` *by matching the IP address of the originating host of the print job with the authenticated SavaPage Web App Session on the same host.* - This type of authentication is applied for jobs printed to a :ref:`Public SavaPage Printer ` with |RST_BUTTON_STANDARD| Authentication, or from a :ref:`Trusted SavaPage Queue ` where the originating User is :ref:`Abstract `. - When no authenticated Web App session is found the job is ignored. .. _ch-auth-basic: Basic Authentication ~~~~~~~~~~~~~~~~~~~~ *Getting the identity of the printing* :ref:`Person ` *by an IPP enforced* `Basic Authentication `__ *(username/password) dialog.* - This type of authentication is applied for jobs printed to a :ref:`Public SavaPage Printer ` with |RST_BUTTON_BASIC| Authentication, .. _ch-auth-mailprint: |MAILPRINT| Authentication ~~~~~~~~~~~~~~~~~~~~~~~~~~ *Deduction of the printing* :ref:`Person ` *using the email address of the sender.* - This type of authentication is applied for print jobs coming in from :ref:`Mail Print `. - When no unique matching :ref:`Person ` is found, or when the Person is disabled, authentication fails. Consult :ref:`Edit User ` on how to mark a User as (enabled) Person. .. _ch-auth-print-key-concepts-local-user: Local User ~~~~~~~~~~ *A* :ref:`User ` *defined on a local device.* .. _ch-auth-print-key-concepts-local-abstract-user: Local Abstract User ~~~~~~~~~~~~~~~~~~~ *An* :ref:`Abstract User ` *defined on a local device.* .. _ch-auth-print-key-concepts-local-person: Local Person ~~~~~~~~~~~~ *A* :ref:`Person ` *defined on a local device.* .. _ch-auth-print-key-concepts-user-alias: User Alias ~~~~~~~~~~ *An alternative name for a* :ref:`User `. - A single User can have several aliases. - An alias is applied at the following levels: - User login to the User and Admin Web App via the :ref:`Login dialog `, or the :ref:`XML Web Services API `. - Print jobs arriving in the SavaPage queues under the alias name. For more information see :ref:`User Name Aliases `. .. _ch-auth-print-key-concepts-abstract-user: Abstract User ~~~~~~~~~~~~~ *A* :ref:`User ` *who is not a* :ref:`Person `.