Offline Secure Release Printing

Offline Secure Release Printing (OSRP) lets users release a print job from a virtual pull print queue even after they have shut down, placed the computer in sleep mode (low power), hibernate mode (no power), or logged out of a virtual session.

Overview

For offline printing, the Service Client holds a copy of the print job until it is released. When PrinterLogic determines that the end-user is offline, and that the end-user is allowed to release offline print jobs, then the Service Client releases the copy to the printer.

Offline Secure Release Printing currently functions with only the Windows client and Windows Service Client.

Prerequisites

On the Service Client machine it is necessary to open certain ports depending on the services you are running, as well as installing OpenSSL.

  • TCP 31988 -- PrinterApps service
  • TCP 31989 -- OSRP service
  • TCP 31990 -- Simple Badge service
  • OpenSSL must be installed on the Service Client.

A Service Client is a machine used for several features within the PrinterLogic application. It can be a workstation or a server always available on your network.

  1. Log in to the Admin Console.
  2. In the tree view, select the parent folder you would like for the Service Client Object.

  3. Click New then Service Client.

    • Right-click on the folder for the same options.

    Admin Console tree view showing the New then Service Client options as seen after right-clicking on a folder.

  4. Add an identifiable name to the Service Client.

  5. Enter the IP Address or FQDN of the Service Client host machine.

    If using HTTPS, an FQDN is suggested to reduce potential communication issues. This is especially important for CPA manufacturers such as Ricoh, Toshiba, and Kyocera.

    Service Client pop-up with fields for the Name and the IP Address or Hostname, and the Add Service Client and Cancel buttons.

  6. Click Add Service Client.
    • The Service Client displays in the tree view under the folder it was added.
  7. Navigate to the machine designated as the Service Client.

  8. In the system tray or start menu, manually Refresh Configurations.

    Refresh Configuration steps as seen from the system tray.

  9. Verify the service is running via Task Manager.
  10. Open Task Manager and select the Processes or Details tab.

  11. Confirm the PrinterLogicServiceManager.exe process is running along with the three client processes.

    Task Manager Details tab view with the PrinterLogic Service Manager service running and highlighted.

    Each service you enable on the Service Client starts a new service viewable in Task Manager.

  1. In the Admin Console, click Tools then Settings then General.

    Admin Console with the Tools menu on the right expanded to show the General option in the Settings section.

  2. Navigate to the Identity Provider Settings section select LDAP and click Add.

    General tab Identity Provider Settings section with an arrow pointing to the LDAP option, and the Add button highlighted to the right.

  3. In the LDAP settings window, fill in the required fields. For the core functionality, PrinterLogic does not require LDAP access to be configured. Any time PrinterLogic requires LDAP authentication the LDAP settings apply. For example, if logging into the Admin Console using LDAP credentials, logging into the Self-service Portal with LDAP credentials, and use any advanced features such as CPA, the mobile app, or Email Printing.

    LDAP Settings pop-up with the different fields showing to configure the LDAP connection.

    1. Enter the Domain Name of your LDAP domain and hit the Tab key.
    2. The NETBIOS Domain Name and Base DN fields should fill in automatically.

    3. Add additional information as listed below:

      1. Primary LDAP Server: The external (public) IP address or FQDN that is port-forwarded to your primary LDAP server
      2. Internal Primary IP: The internal (private) IP address or FQDN of your primary LDAP server. Not required but may be necessary depending on your network security.
      3. Secondary LDAP Server: The external (public) IP address or FQDN that is port-forwarded to your secondary LDAP server. Not required but may be used if needed.
      4. Internal Secondary IP: The internal (private) IP address or FQDN of your secondary LDAP server. Not required but may be used if needed.
      5. LDAP Port and LDAP Server Requires Secure Sockets: Port 389 for LDAP. Port 636 is for secure LDAP/LDAPS. By checking the box for LDAP Server Requires Secure Sockets, the port number will automatically change to 636. A firewall rule for the port used in the LDAP configuration will need to be created unless the configuration uses Identity Sync through a Service Client.
      6. Domain Alias: Not required
      7. Bind User: Bind User Name
      8. Bind Password: Password for entered Bind User Name
      9. Server Type: Select the server type you are using.

  4. When you finish entering the LDAP settings, click Test Settings to ensure the settings are correct. Successful test results display a green check mark. The Complete status appears whether the test passes or fails, but a red X displays next to the failed test.

    Testing LDAP Settings pop-up showing three complete tests, and the secondary LDAP server test showing as failed.

    The Skipped status appears if a field in the LDAP settings is left without a value or if the value in the field cannot be found. The Result column displays a message that lets you know the reason it was skipped.
    Testing LDAP Settings pop-up showing three complete tests and one skipped test.

  5. Click Apply.
  6. (Optional) In the Default domain when logging in field, select the LDAP domain you have created.

  7. Click Enable Advanced LDAP Administrative Authentication.

    General tab's Identity Provider Settings section with an arrow going to the Default domain drop-down and the Enable Advanced LDAP authentication check box.

  8. Click Save.

Delete Provisioned LDAP Data

At times it becomes necessary to delete provisioned LDAP users and groups from the PrinterLogic database. The delete function enables IT Admins to remove these items. For legal reasons, PrinterLogic Support cannot remove these and leaves this action to the discretion of the IT Admin. This process requires obvious interaction to remove the user and groups to ensure deletion is the desired outcome.

This action will delete all LDAP users and groups from the PrinterLogic database for all configured AD domains and require you to provision them again. The RBAC, Portal Security, and Printer Deployment rules associated with these users and groups will continue to function unless the admin manually deletes them. You cannot undo this action.

FAQ

No, it does not. This function will only remove provisioned data from the PrinterLogic database. You must complete that process within the LDAP server if you need to remove a user.

Process

  1. In the PrinterLogic Admin Console, navigate to Tools then Settings then General.
  2. In the Identity Provider Settings section select the LDAP option.

  3. In the LDAP Sync section select the Delete Provisioned LDAP Data option.

  4. Type DELETE into the text field.
  5. Click on Delete.

    6. Delete LDAP Provisioning Data pop-up with the warning showing, and the word Delete typed in the entry field.

  6. Click on Save.

Install OpenSSL

OpenSSL performs the encryption of the print jobs waiting to be released. OpenSSL will need to be installed on any Service Clients that are used to hold offline print jobs.

  1. If not currently installed, install Win32 OpenSSL.
  2. Add OpenSSL to the PATH variable.
    1. Windows 10 / Server 2016.
      1. Click on the Start menu and type path.
      2. Click on Edit the system environment variables.
      3. Under the Advanced tab, click on the Environment Variables button.
      4. Under the System Variables section , click on Path then click Edit.
      5. In the new popup box, click Edit.
      6. Double click on the next available empty line.
      7. Enter the path to the OpenSSL bin folder. For example "C:\Program Files (x86)\OpenSSL-Win32\bin"
    2. Windows 7 / Server 2012
      1. Click on the Start menu and type path.
      2. Click on Edit the system environment variables.
      3. Under the Advanced tab, click on the Environment Variables button.
      4. Under the System Variables section, click New.
      5. For the variable name enter something like "OpenSSL"
      6. For the variable value enter the path to the OpenSSL bin folder. For example "C:\Program Files (x86)\OpenSSL-Win32\bin"
      7. Click Ok
  3. After installing OpenSSL, reboot the machine.

Enable OSRP

Enabling this option starts the PrinterLogicServiceOfflinePrint.exe on the Service Client machine.

  1. In the Admin Console tree view, select a service client object.
  2. Click the Offline Printing tab.

  3. Click Enable Offline Printing.

  4. Click Save.

Service Client's Offline Printing tab showing the option enabled.

Set Service Client on IP Address Range

Using IP Address objects allows you to designate the service client object used to hold the copy for users within that range.

  1. In the Admin Console tree view, select an IP Address Range object.

  2. In the General tab, select the Service Client drop-down and select the preferred Service Client.

  3. Click Save.

IP Address Range's General tab with an arrow poitning to the Preferred Service Client drop-down.

Filter OSRP Users

Use filtering to designate specific users/groups, IP Address Ranges, hostnames, etc. that can use this feature.

  1. In the Admin Console, click Tools then Settings then Printing.

  2. In the Pull Printing section, click Show Filter.

  3. Click Add.
  4. Select the type of filter you would like to add.
  5. Follow the wizard to set up the filter.
  6. Click Save.

Printing tab's Pull Printing section showing the enabled Offlline Secure Release settings, and the Expanded filter where specific users/groups can be added to use this feature.