This article covers common questions about Card/ID numbers and card readers which can be used with PaperCut MF for photocopier access control and secure print release.
Where can card readers be used?
PaperCut integrates with card reader technology to give users the ability to swiftly authenticate with their proximity card, ID badge. Allowing users to securely release print jobs or gain access to functions like scanning an copying, without having to enter a password.
Here are some of the places where this can be implemented:
-
MFDs/MFPs and terminals for authentication:
When performing copying, scanning or faxing at an MFD with PaperCut MF, users typically first authenticate by username and password, entering their id number, or presenting their card (authentication support between platforms differs so not all of these options may be available).
A variety of card reader brands and card technologies may be supported. Common card reader brands include RFIDeas and Elatec . Common card reader technologies include magnetic stripe (AKA magstripe, swipe card, magswipe), MIFARE, HID iCLASS, HID Prox, Indala and barcode.
The types of card reader supported depends on the copier/MFD platform. In general, card readers supporting the USB HID specification (e.g. devices that “emulate” a keyboard) are supported on most platforms. PaperCut resellers possess a detailed matrix of copier brands and their supported card readers, so contact your PaperCut reseller if you need further information about a particular platform, card reader brand or card technology.
-
To release print jobs at a basic printer with using a networked card reader:
Fast Release is a solution designed to enable Find-Me Printing and Secure Print Release for basic single-function printers that don’t support the PaperCut MF embedded application. This requires 3rd party hardware to have a card reader communicate directly with the PaperCut server over the network, and is only available for PaperCut MF customers. -
PaperCut print release stations for authentication and/or payment:
Users can authenticate to a PaperCut print release station using username and password, entering their id number, or if configured, presenting a card. Card authentication provides the convenience of less typing. Any keyboard emulating card reader is supported here.
-
Workstations for Web Cashier operators to look up users:
PaperCut Web Cashier is a system for charging for arbitrary disbursements (e.g. binding in a print room) and/or entering cash payments. When selecting a user to charge/credit, the operator may user a username or a Card/ID Number. Using a card reader here allows the operator to identify a user without having to type in the number, e.g. by asking the user to present their card for identification.
Any keyboard emulating card reader is supported here.
-
Workstations for administrators to look up users:
In PaperCut’s web-based administrator interface (check out the demo at demo.papercut.com ) administrators may search for a user by username or Card/ID Number. Administrators may find it helpful to have a card reader attached to quickly find the matching user, e.g. if they are in the process of distributing cards or testing a particular user account that they have the card for.
Any keyboard emulating card reader is supported here.
-
Other 3rd party devices for authentication and/or payment:
Other 3rd party devices such as payment kiosks commonly support card readers. Consult the hardware supplier for more information.
Where can I purchase card reader hardware compatible with my device?
Normally customers obtain card readers at the same time as they make arrangements to install devices from their hardware supplier. Please note that the card reader hardware required can depend on the multi-function devices being used, as some manufacture only support their own proprietary card solutions.
Specific information about which card readers work is given in the embedded manual for each of our supported solutions and you PaperCut MF reseller can usually assist with with obtaining any necessary hardware. If you are a PaperCut reseller you should contact your PaperCut Authorised Solution Centre or your local supplier (e.g. Local RFIDeas or Elatec supplier)
Which track/sector does PaperCut use on a card (e.g. a Magnetic strip card)
It is down to the reader what information PaperCut readers from a card. Typically a magnetic strip reader will read data from 1 of 3 tracks on the magnetic strip. Some “multi” track magstrip readers can be config to read data from a specific track if needed. This is configured via a downloaded configuration utility.
Typically a prox reader will read a unique serial number from a card. This is generally what an organisation would want, in reality a PaperCut Admin would not mind what number was read as long as it was unique for each user. If you wish to read a different sector from a proximity card then it is possible to read other sectors assuming you have a “playback reader”. These look and cost much the same as normal card readers but the firmware on the device acts differently. Playback readers can be programmed using a configuration utility to read certain sectors from a card. Reading other sectors requires you to know an encryption key. Most sectors would be encrypted by whoever created the card (the door access supplier for example) The configuration utility needs to have an encryption key entered into it, so it can read from that sector. Most cards are protected by two keys, A and B. Key A allows a user to read the sector and key B allows you to read and write to the sector. Key A is all you would need in most cases. It is not often anyone needed to change the sector to read from as part of a PaperCut install.
What is the best way to mount a card reader onto an MFD/Copier/Printer?
The simplest method is to directly attach a card reader to the device with double-sided tape, or 5 minute epoxy resin, however in educational environments a more permanent, tamper-proof approach is called for, and many devices provide a cavity for this purpose. Alternatively a card reader may be mounted within the MFD itself. A common internal mounting option is to double-sided tape in the reader inside the scanner feeder hopper on the copier’s lift lid (note: some minor disassembly will be required if mounting inside the feeder, and PaperCut recommends that this only be performed by a certified copier technician or a PaperCut certified ASC). If mounting internally, where space is at a premium, it may be necessary to remove the card reader’s protective case. Ensure to mount the reader behind a prominent flat surface.
What is a “keyboard emulating” USB card reader?
A keyboard emulating USB card reader is a card reader that acts just like a keyboard by “typing” the card number each time a card is swiped. Keyboard emulation can be easily tested. To do this, plug in the card reader, open a text editor application (like Notepad or Word) and then swipe the card. If the card number appears in the text editor as if it was typed, this card reader is said to be “keyboard emulating”.
Keyboard emulation depends on driver support, although the majority of card readers available support the USB HID specification and do not require any additional drivers or software to enable keyboard emulation (the drivers are typically bundled with the operating system).
Some card readers require specific drivers to enable keyboard emulation.
A small number or card readers do not support keyboard emulation at all (software wanting to support these card readers must build-in support for their specific driver). Where possible PaperCut’s embedded solutions aim to support a wide array of readers. Internally PaperCut’s embedded software includes a number of ‘drivers’ and will auto-detect as appropriate.
My card reader is reading numbers in a format different to my records. How can I convert the format? (e.g. Hexadecimal to Decimal)
Card readers are configured to expect cards to be formatted in a certain way. Sometimes you may be in a position where a card reader is expecting a format that is different to the format your cards are written in. If you’re only using cards readers for self-association then there may not be a need to change any configuration; just as long as each card produces a unique number. However, if you have existing user records with card numbers and want those to match the card reader output then you will need to ensure all of your card readers are working as expected.
If you find the your card readers are not reading the correct number then you need to either reconfigure PaperCut or the card reader hardware. Hardware configuration is ideal if you only have a small amount of devices to update (see option 1). The process is different for each card reader manufacturer, and you will need physical access to the device as well as the configuration software that the manufacturer provides. Alternatively, if you have many devices then it may be quicker to configure the card number format conversion in “software” - that is in PaperCut itself.
-
Option 1: Hardware (Re-program the card reader)
Most card readers have the ability to be reconfigured to read in different formats. Refer to the utilities and manuals provided by your card reader manufacturer.
-
Option 2: Software (Regex settings inside PaperCut)
If you just want to use a subsection of the card number as an identifier you can use regular expressions to define which part of the card number is the identifier. This can done in the advanced configuration page; either globally, or for the specific device you wish to configure. Set the ext-device.card-no-regex key to the regular expression you need.
Example: You have a batch of cards that start with the same value, with only the last 4 digits being the unique identifier. Eg
1234–5677–1268,1234–5677–1363,1234–5677–9992An appropriate regex would be:
\d*-\d*-(\d)*Resellers will find more information in the embedded manual chapter titled “Configuring Swipe Card Readers”.
-
Option 3: Software (filter/converter settings inside PaperCut)
If you have many card readers that are reading incorrectly it may be easier to configure PaperCut to convert the card number to a different format. PaperCut comes with a number of pre-built converters for common operations such as hexidecimal to decimal, decimal to hexidecimal and ascii encoding converters. For the more advanced use cases you can write your own converter in JavaScript.
Example: Card is being read in hexidecimal format (
946EBD28), but your records are kept in decimal (2490285352). Activating the hex2dec converter would make PaperCut do the conversion from hexidecimal to decimal.Resellers will find more information in the embedded manual chapter titled “Configuring Swipe Card Readers”.
I have mixed card types on my network. What are the options?
We’ve heard of this as a common problem when organizations merge, or on sites where there are multiple security solutions for door access. The challenge is that many users have cards that work differently or are incompatible with existing card readers. Thankfully there are some multi-readers available from vendors that may work as a solution. Some factors which have precluded the use of a multi-reader in the past are:
- Multi-readers are more expensive. It may be a viable solution for small deployments, however can get quite expensive in organizations with large MFD fleets.
- Some multi-readers are quite slow at reading as they need to scan a wider frequency range.
An alternate and popular option is “dual frequency” the cards using RFID data dots (RFID ID stickers). Rather than using a multi-reader a single reader type is selected and cards not compatible with this reader have a data-dot sticker applied. Care needs to be taken to ensure the data dots selected don’t clash with the physical cards. We recommend careful testing to validate your selection prior to production deployment.
I’d like to see if my card format can be read by a reader. How do I get it tested?
Contact your nearest Authorized Solutions Centre , who will be able to answer any questions you may have, or organize any necessary tests.
Can I get assistance with troubleshooting my card reader?
Start by checking to make sure the MFD works without the card reader by using a different authentication method like username and password. After confirming the authentication problem is isolated to the card reader, try swapping the reader, MFD or user to see if the problem can be further narrowed down.
If you’re using PaperCut MF, then it’s worth contacting your Reseller or Partner to help out with initial card reader configuration or to start the troubleshooting process. They’ll often have any specific configuration for the card reader / device combination that you’re using in your local environment.
Their contact details can be found in the PaperCut admin interface, under the ‘About’ tab - find your local partner or contact under the ‘Sales and Solutions Contact’ and ‘Support’ sections.
I receive an “Uncertified USB card reader found” message on a Ricoh MFD. What is this?
The Ricoh platform only supports a limited number of specific card readers. Please refer to the PaperCut Embedded manual for Ricoh (Appendix A) for details.
My card reader doesn’t work on my Toshiba MFD. Why?
Toshiba MPFs, both eB3 and eBX types, support a variety of card readers. To support a card reader’s, it’s important that the Toshiba copier is correctly configured. Recently, eBX devices have added support for Magtek card readers. A number of things should be checked (as described in the Toshiba Embedded Manual):
- The 08 codes and values are set correctly for the type of card reader. The 08 code is different for eBX versus eB3 but both these devices use the same 08 values depending on the card reader type.
- Check that LDAP card authentication is turned on for the correct PaperCut LDAP server.
- Ensure that the card reader is connected prior to the MFD boot up.
- If using an Elatec TWN3 card reader, then it needs to have Toshiba firmware installed on it.
What is two-factor authentication (Card + PIN)?
Two factor authentication means “something you know” and “something you have”. For PaperCut and card authentication this means turning on Card + PIN authentication (Card - you have, PIN - only you know).
My users employ their PIN instead of their network passwords to authenticate. Are they able to perform card self-association using their PIN?
We’ve spoken with a number of sites wherein users aren’t privy to the passwords for their network accounts, and instead use a PIN exclusively. In the past, card self-association would require a user to authenticate with their formal network credentials, rendering it an unviable feature for those sites. As of PaperCut MF 17.3, it is now possible to authenticate during card self-association using a PIN instead of a password.
To enable PIN authentication for card self-association, you’ll need to modify an advanced configuration key via the Config Editor . The key in question:
ext-device.card-self-association.auth.allow-password-or-pin
By default, attempting to authenticate with a username and PIN when self-associating will fail. When the above configuration key is changed from N to Y, self-association with either a username and PIN or a username and password will be possible.
Is there a way to enforce a minimum length for the card number?
Yes, you can enforce a minimum length by changing the value of the config key user.card-id-min-length. The default value is 1. You can set it to a value of your choice. Change the value of a config key via Options → Config Editor. Information on how to use the config editor is given
here
.
Can I synchronize PINs from a domain, the same way that I synchronize card/ID numbers?
PIN synchronization with common directory services is achievable as of PaperCut MF 17.3. To get this working, you’ll need to tell PaperCut MF what field to retrieve these PINs from in your directory listing; this is done using an advanced configuration key, modifiable via the Config Editor .
If your Primary sync source is configured to be Windows Active Directory, the configuration key to populate with the name of your PIN field is as follows:
user-source.ad.user-pin-field
If your Primary sync source is set to LDAP, you’ll instead want to use this key:
ldap.schema.user-pin-field
Alternately, if you wish to retrieve PINs from an LDAP synchronization source which is configured as your Secondary sync source, you’ll need this key:
ldap.2.schema.user-pin-field
You can find more information about how to customize your synchronized LDAP fields in the following section of our online User Manual .
How do I get my card numbers into PaperCut?
PaperCut offers a variety of ways to get card numbers into the PaperCut database, including:
- By automatically importing the number from a field in a user directory like Active Directory or LDAP when synchronizing users into PaperCut.
- By configuring PaperCut to perform a lookup on an external database system (e.g. a security card system).
- By importing the numbers from a text file .
- Users can self-associate their card by swiping and entering their username/password on supported MFD and other hardware.
- Using the server-command or web service APIs .
- By manually entering the card number in the user details page.
For more information see the Card/ID Number Overview .
Comments