Virtual Appliance Troubleshooting

Are the default printer admin credentials correct?

CPA installations can fail if the admin username and password are incorrect. You can resolve this issue by modifying the credentials used for CPA installation. With the Modify option in the CPA Manager, update the credentials for multiple printers as long as they are the same brand. Often, the default admin name and password are the same multiple manufacturers.

The CPA requires a Service Client to install apps to the printer. Check that the Service Client machine is not shut down or in an error state.

On the machine, open the Task Manager and select the details tab. In the Search field, type "printer" to locate the Client processes.

If neither the PrinterLogicServiceManager.exe or PrinterLogicServicePrinterApp.exe processes are running on the Service Client device, verify the Client installation and / or check the Service Client was installed properly.

Verify the Client is installed, authorized and pointing to the correct instance. A quick test is to click the system tray icon to open the Self-service Portal. If it opens to the correct URL, you can sign in, and see / install printers from the portal, then the client is authorized.

If you're prompted for an authorization code in the Self-service Portal, see Device Authorization for steps on how to create one.

If the Self-service Portal opens to an incorrect URL, you'll need to set the home URL. See Update the Client Home URL.

Navigate to C:\Program Files (x86)\Printer Properties Pro\Printer Installer Client\ServiceHost. and check the following:

If the Service Host folder is not created, check the machine's hostname or IP address and compare with what you entered for the Service Client in the Admin Console.

If the folder is created, check the config folder in it. A token.json file is saved here when the Service Client is authorized.

If the folder is created, but the token.json file is not there, you need to reauthorize the Service Client, see Reauthorization Steps. Please note that the Service Client authorization is different from the Client authorization.

Use the following steps to generate a new authorization token for a Service Client if it's missing, or if the PrinterLogicServiceManager.exe service is crashing.

Reauthorize the Service Client only if you've checked the URL, client authorization, and folders first. Complete the steps below within two minutes or the reauthorization fails.

1. On the machine set up as the Service Client, navigate to C:\Program Files (x86)\Printer Properties Pro\Printer Installer Client\ServiceHost/Config.
2. Verify if there is an existing token.json file. If there is, delete the file.
3. Open the Task Manager.
4. Select the Details tab.
5. Right-click on PrinterInstallerClientLauncher.exe and select End Process Tree. There are three PrinterInstallerClient processes running for the Client. If the other two services don't close, then close them individually.
6. In the Virtual Appliance Admin Console, navigate to the Service Client object.
7. Select the Service Client and in the General tab, select Reauthorize.
8. Select Okay to close the message.
9. Back on the Service Client machine, select the Services tab in the Task Manager.
10. Right-click on PrinterInstallerLauncher service and select Start.

Once the services start, the machine pulls down a fresh token.

This is a generic communication error. A few things to check are:

1. The Service Client is not listening over port 31988. Update the configuration to allow listening over port 31988.
2. The printer does not trust the Virtual Appliance certificate. Register or upload a new certificate.

Fuji Xerox Specific

In the printer settings, configure the Domain Name within the DNS Configuration settings to see if it resolves.

At a minimum, the printer requires a self-signed certificate. If an Amazon Root CA 1 certificate is not installed, follow this link to see the steps to obtain the certificate so you can manually install it on the printer.

By default, the Visual C++ Redistributable for Visual Studio 2015 (32-bit/64-bit) or newer is typically already installed. However, both the x86 and x64 redistributable packages must be installed on the Service Client to generate the items required for a successful installation. Without the packages, the Service Client cannot initiate the app service. You can find these packages in the Microsoft Download Center.

A quick way to do this is to right-click the Client icon in the system tray of the Service Client machine and select Refresh Configurations.

The CPA requires the use of an IdP. This can be LDAP or another IdP such as Entra ID (Azure AD), Okta, etc.

The CPA requires an email address associated with each IdP user, which it uses as the username when logging in. This scenario occurs when an email address has not been associated with the user within the IdP.

Sometimes printer-specific drivers can cause installation issues for the CPA. Use a universal print driver to ensure a smooth and successful installation.

Check the following:

1. Verify that the IP Address assigned to the printer is accurate within the Admin Console.
2. Ensure that you can successfully ping the printer from the Service Client machine.

You can find the log file on the Service Client machine at the following path:

Windows:

C:\Program Files (x86)\Printer Properties Pro\Printer Installer Client\service-printer-app\log\PrinterLogicServicePrinterApp.log

Mac/Linux:

/opt/printerinstallerclient/log/printerlogicserviceprinterapp.log

This issue likely stems from incorrect Authentication / Accounting Type settings located at Permissions Authentication and Accounting Authentication / Accounting Type. When using badging, ensure the setting is configured to Custom and restart the device.

At a minimum, the printer requires a self-signed certificate. If an Amazon Root CA 1 certificate is not installed, follow this link to see the steps to obtain the certificate so you can manually install it on the printer.

Some Ricoh models may require specific card reader settings.

Before you follow the steps below, if the CPA is installed in SSO provider mode you will need to uninstall the CPA first.

1. Ensure the USB card reader is connected to the device's panel and NOT the back of the device.
2. From the device's panel, log in as Machine Administrator.
3. Navigate to User Tools Screen Features Screen Device Settings IC Card/Bluetook Software Settings Select IC Card Reader and set to Proximity Card Reader.
4. Select Proximity Card Reader Settings.
5. Empty the list.
6. Return to the Select IC Card Reader settings accessed in step 3, and set to Do not use.
7. Reboot the device.

If the installation fails with an InvalidSolutionsKeyError, update the printer's region in the firmware settings.

The Fuji Xerox CPA requires the Customized Login option set and enabled. Normally this happens during the CPA installation. If the option is not visible on the printer, enable the Customized Login option using the printer's Service Mode.

1. Log in to Service Mode from the panel on the device.
2. Select Tools.
3. Select Common Service Settings.
4. Select Maintenance / Diagnostics.
5. Select the NVM Read / Write option.
6. Set the chain-link to 700-497.
7. Set the New Value to 0.
8. Exit Service Mode and reboot the device.

Once the device reboots:

1. Log in to the printer's control panel.
2. Navigate to the Login Types settings. The path to these settings may vary by model.
3. Select the Customized Login option.

If you are seeing alias is automatically stripped from the To: field, set up a distribution group:

1. Remove the alias from the original account.
2. Create a distribution list called <printername>@<domain>.com. Example: HPXXX@example.com.

3. Set the only member of the list to the main mailbox. Example: example@example.com.

   The main mailbox set for the pull printer on the Service Client's Email Printing tab.

Mail should be delivered to the main mailbox, with <printername>@<domain>.com in the To: field.

In some setups, external applications may need to reach the Output Automation Service Client using a DNS name that resolves to an external IP address. However, this can cause issues the following issues:

• The Service Client cannot resolve the DNS name to its internal IP address.
• External DNS resolution conflicts with internal requirements.

Check if the Service Client can resolve the DNS name to its internal IP address. If the DNS name doesn't resolve correctly, you may need to modify the hosts file. See Troubleshoot DNS Resolution for Output Automation-Service Client

Ensure that the DNS name in the UI matches the one in the certificate used by the Service Client.

If the Output Automation logs have no activity from print jobs, make sure ports are open and the network traffic is flowing. You can use the Check Connection option of the Spool Administration: Output Device (Display) window to verify SAP is reaching the LPD service.

If the Output Automation logs show a error relating to an unsupported command, check the following:

• Make sure the Access Method for the output device is U.
• Make sure the Device Type for the output device matches the destination printer as closely as possible.
• If those look good, there may be a new message type that needs to be supported. Contact support.

1. Open developer tools in the browser and select the Network tab.
2. Select the CAC / PIV Login button.
3. Watch for red entries, and investigate.
4. If the page says "Unable to process CAC Login" look for an error on acquire.php. If you hover over that entry, it should tell you what happened.
   1. An ERR_NAME_NOT_RESOLVED means that the workstation could not resolve the pivcac CNAME entry.

Federal agencies often have to cycle their service account passwords. Ensure that the service account password is correct by:

1. Navigate to the Identity Provider Settings section on Tools Settings General.
2. Select the domain, then select Modify.
3. Select the Test Settings button.

If the Connection with Bind User/Password test fails, the bind username and password require updating.

Verify CAC / PIV Certificate.

• Examine the certificate being used to authenticate to the Admin Console.
• Verify that the certificate has not expired.
• Verify that the certificate is trusted and that all Certificate Authority (CA) in the chain are installed in the respective trusted CA stores for the Local Machine
• Verify the way the certificates are mapped to users inside of Active Directory (AD).
  • Are CAC / PIV certificates mapped to multiple AD user accounts through Name Mappings in AD Users and Computers?
  • Do the CAC / PIV certificates have a PrincipalName entry inside the subjectAlternativeName extension?
  • Does this PrincipalName match the userPrincipalName for the user inside of AD?

If held print jobs are not visible in the mobile app make sure the end users are logged into the client on the workstation and that is the same user credentials that are being used to log into the mobile app.

Most commonly this is because when you printed from your workstation, you selected a specific printer to print to. Depending on how your environment is configured, it is assumed you are performing a secure print function, and want to print to that specific printer. If this is the case, go to the selected printer and either select the Print Release option, or if configured, scan the QR codeoption.

If your user can't sign in to the mobile app make sure they can log into the Self-service Portal with the same credentials they are using on the app. If they cant, then it's most likely an issue with the IdP implementation.

If your end users are not able to print to a specific printer, first make sure their mobile device can communicate with the printer. Another thing to check is that the printer supports IPP, that it is enabled, and TCP Port 631 and 80 are open. If neither of those fix the issue, check to make sure IPPS is not enabled since IPPS is not supported by Virtual Appliance and conflicts with the printing process.

Although held print jobs generally show up on the app very quickly, depending on your network, a print job may take a short period of time to show in the app. Sometimes you may need swipe down on the print release screen to refresh.

Another consideration is how long it has been since you printed the job. As a default, held print jobs are only kept for 12 hours before being purged. This setting can be modified to be shorter or longer by the application administrator. Confirm with them on what this time is set to.

Only printers that are manually added to the mobile device can be deleted. Printers that have been deployed to the mobile device by the administrator cannot be deleted from within the app.