<!-- wp:spacer {"height":30} -->
<div style="height:30px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:paragraph -->
<p>Access Management and Identity as a Service (IDaaS) solutions for PaperCut are questions we are often asked here at Selectec. These solutions are designed to save admins time when onboarding new staff members, or granting access to applications and services, as well as providing a greater level of security by having a centralised credential system. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This provides users with one user account, which means they can use any service they need to use (assuming the provider supports it) without having to generate or store a new username and password per service.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Let's take a look at a few of the different options and how you can use them with PaperCut (over time this will be updated as we get asked about other providers).</p>
<!-- /wp:paragraph -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:heading {"align":"left","level":3} -->
<h3 class="has-text-align-left">Okta</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>To get Okta working with PaperCut the quickest and recommended solution would be to use the&nbsp;<a target="_blank" href="https://www.google.com/url?q=https://help.okta.com/en/prod/Content/Topics/Directory/LDAP_Using_the_LDAP_Interface.htm&amp;sa=D&amp;ust=1582717183075000&amp;usg=AFQjCNHi9PXry7S519vqGCh-sQb2qjANqA" rel="noreferrer noopener">Okta LDAPS connector</a>, this will allow you to sync your user accounts and authenticate from any of PaperCut's user-facing clients.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Here's how you do it:</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>LDAP Server Type:</strong>&nbsp;Standard (Unix / Open Directory)</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Hostname:</strong>&nbsp;&lt;org_subdomain&gt;.ldap.&lt;domain&gt;.com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Use SSL:&nbsp;</strong>Checked</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Base DN:</strong>&nbsp;ou=users,&lt;dc=org_subdomain&gt;, dc=&lt;domain&gt; , dc=com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin DN:</strong>&nbsp;uid=&lt;username&gt;,&lt;dc=org_subdomain&gt;,dc=&lt;domain&gt;,dc=com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin Password:</strong>&nbsp;CorrectHorseBatteryStaple</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>With OKTA &lt;domain&gt; could be oktapreview, Okta or okta-emea depending on region and if you are in the preview program.</p>
<!-- /wp:paragraph -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:heading {"align":"left","level":3} -->
<h3 class="has-text-align-left">OneLogin</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Onelogin, like Okta, has a good set of features, APIs and app integrations you can use along with also having an&nbsp;<a target="_blank" href="https://www.google.com/url?q=https://onelogin.service-now.com/support/?id%3Dkb_article%26sys_id%3D7b3ad943db109700d5505eea4b9619db&amp;sa=D&amp;ust=1582717183076000&amp;usg=AFQjCNHeaV3LBnA99p5m7dmVizKJrquhGQ" rel="noreferrer noopener">LDAP interface</a>&nbsp;which makes importing and authenticating users in PaperCut simple.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>LDAP Server Type:</strong>&nbsp;Standard (Unix / Open Directory)</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Hostname:</strong>&nbsp;ldap.us.onelogin.com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Use SSL:&nbsp;</strong>Checked</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Base DN:</strong>&nbsp;dc=&lt;subdomain&gt;,dc=onelogin,dc=com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin DN:</strong>&nbsp;cn=&lt;email&gt;,ou=users,dc=&lt;subdomain&gt;,dc=onelogin,dc=com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin Password:</strong>&nbsp;CorrectHorseBatteryStaple</p>
<!-- /wp:paragraph -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:heading {"align":"left","level":3} -->
<h3 class="has-text-align-left">Jump Cloud</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Jump Cloud is one we have&nbsp;<a target="_blank" href="https://www.google.com/url?q=https://staging.selectec.com/syncing-papercut-with-jumpcloud/&amp;sa=D&amp;ust=1582717183070000&amp;usg=AFQjCNGjpaR9UKm80N9DQf83nIZ7LoKXzQ" rel="noreferrer noopener">covered before</a>, but to make this list a bit more complete, it is worth adding. The quick version is you can use LDAPS to sync and authenticate your users.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>LDAP Server Type:&nbsp;</strong>Standard (Unix / Open Directory)</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Hostname:</strong>&nbsp;ldap.jumpcloud.com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Use SSL:&nbsp;</strong>Checked</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Base DN:</strong>&nbsp;ou=users,o=&lt;org_id&gt;,dc=jumpcloud,dc=com&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin DN:</strong>&nbsp;uid=&lt;username&gt;,ou=users,o=&lt;org_id&gt;,dc=jumpcloud,dc=com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin Password:</strong>&nbsp;CorrectHorseBatteryStaple</p>
<!-- /wp:paragraph -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:heading {"align":"left","level":3} -->
<h3 class="has-text-align-left">FoxPass</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>FoxPass gives you all the features you would expect when it comes to access management and has support for Linux desktops and Servers along with wifi authorisation through RADIUS and a bit of management for SSH keys.  It also has an&nbsp;<a target="_blank" href="https://docs.foxpass.com/docs/ldap-overview-debugging" rel="noreferrer noopener">LDAP interface</a>&nbsp;that you can use with PaperCut for importing and authenticating users.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>LDAP Server Type:&nbsp;</strong>Standard (Unix / Open Directory)</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Hostname:</strong>&nbsp;ldap.foxpass.com</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Use SSL:&nbsp;</strong>Checked</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Base DN:</strong>&nbsp;dc=&lt;domain&gt;,dc=&lt;com&gt;&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin DN:</strong>&nbsp;cn=&lt;LDAP binder name&gt;,dc=&lt;example&gt;,dc=&lt;com&gt;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Admin Password:</strong>&nbsp;CorrectHorseBatteryStaple</p>
<!-- /wp:paragraph -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:html -->
[well]<h3 class="has-text-align-left">TL;DR</h3>
<p>The quick version of this is if the ID provider has an LDAP interface, the users can be synced and will be able to authenticate from all of the clients. If there is only a SAML option and you wanted some form of SSO, you would need to import the users manually, then configure a reverse proxy to use Shibboleth with SAML to allow access to the /user or /admin interface.</p>[/well]
<!-- /wp:html -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:paragraph -->
<p><strong>Quick reference guide.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The table below is a quick reference guide to what you would need to put in PaperCut. In the password field, enter your password for that service. We have also (where supported), only opted for LDAPs which should be the default option for everyone now.</p>
<!-- /wp:paragraph -->

<!-- wp:spacer {"height":20} -->
<div style="height:20px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:table {"backgroundColor":"subtle-light-gray"} -->
<figure class="wp-block-table"><table class="has-subtle-light-gray-background-color has-background"><tbody><tr><td><br><strong>Service</strong></td><td><br><strong>Type</strong></td><td><br><strong>Server Address</strong></td><td><br><strong>Port</strong></td><td><br><strong>Use SSL</strong></td><td><br><strong>Base DN</strong></td><td><br><strong>Admin DN</strong></td><td><br><strong>SAML Option</strong></td></tr><tr><td><br><strong>OKTA</strong></td><td><br>Standard</td><td><br>&lt;subdomain&gt;.ldap.&lt;domain&gt;.com</td><td><br>636</td><td>Yes</td><td><br>ou=users ,dc=&lt;subdomain&gt;, dc=&lt;domain&gt;, dc=com</td><td><br>uid=&lt;username&gt;,&lt;dc=subdomain&gt;,dc=&lt;domain&gt;,dc=com</td><td>Yes</td></tr><tr><td><br><strong>OneLogin</strong></td><td><br>Standard</td><td><br>ldap.us.onelogin.com</td><td><br>636</td><td>Yes</td><td><br>dc=&lt;subdomain&gt;,dc=onelogin, dc=com</td><td><br>cn=&lt;email&gt;,ou=users,dc=&lt;subdomain&gt;,dc=onelogin,dc=com</td><td>Yes</td></tr><tr><td><br><strong>JumpCloud</strong></td><td><br>Standard</td><td><br>ldap.jumpcloud.com</td><td><br>636</td><td>Yes</td><td><br>ou=users,o=&lt;org_id&gt;,dc=jumpcloud,dc=com</td><td><br>uid=&lt;username&gt;,ou=users,o=&lt;org_id&gt;,dc=jumpcloud,dc=com</td><td>Yes</td></tr><tr><td><br><strong>Foxpass</strong></td><td><br>Standard</td><td><br>ldap.foxpass.com</td><td><br>636</td><td>Yes</td><td><br>dc=&lt;domain&gt;,dc=&lt;com&gt;</td><td><br>cn=&lt;LDAP binder name&gt;,dc=&lt;example&gt;,dc=&lt;com&gt;</td><td>No</td></tr></tbody></table></figure>
<!-- /wp:table -->

<!-- wp:spacer {"height":50} -->
<div style="height:50px" aria-hidden="true" class="wp-block-spacer"></div>
<!-- /wp:spacer -->

<!-- wp:heading {"align":"left","level":3} -->
<h3 class="has-text-align-left">As always, if you need a helping hand to get up and running, then <a href="https://staging.selectec.com/contact/">get in touch</a> with the team.</h3>
<!-- /wp:heading -->