Configuring user authentication

Note:

The UniconOS package User authentication modules must be installed on the devices. This may require modifications of the image definition file on the web server via ELIAS.

1. In the device configuration, under Security > User authentication, choose from the following authentication methods.

   None	Disables user authentication
   Active Directory	Active Directory (Microsoft directory service)
   AD + smart card	Smart card with Active Directory
   Evidian	Identity and access management via RFID or smart card

   On the eLux® RP 6 client, under Security > User authentication, enable user authentication. Then under Authentication type, choose the method.

2. Click Edit.

3. On the AD directory tab, specify the server, server list or domains to which users may log on. Define multiple entries, if you want to create a selection for users when they log on.

   For Evidian, on the Evidian server tab, specify a server or server list.

4. To help users log on quickly, select the Show last user option.

5. Only for AD: In the Domain field list, choose whether you want to show users the specified domain so they can edit it, or whether you want to hide it.

6. Confirm with OK.

After you have enabled user authentication, the users will be prompted for their username and password after the next device restart. The screen saver is automatically protected by password.

Note:

To devices that are not managed by Scout, administrators may log on with the LocalLogin username and device password to correct any settings, if required.

Setting a default login domain

For Active Directory, AD + smart card and Imprivata, you can set which domain the device preselects on its logon and unlock screens. Where the domain field is editable, users can still choose a different domain. Evidian does not offer this option.

• Active Directory and AD + smart card: on the AD directory tab, open an entry’s context menu and choose Set as default domain. A star marks the default entry, and the menu item changes to Remove default domain. Renaming the default entry moves the default with it; deleting the entry clears the default.
• Imprivata: in the Imprivata user authentication dialog, enter the domain name in Default login domain, up to 255 characters. Leave the field empty to remove the default.

The value must match the name of a domain the device knows; case does not matter. If it matches no domain, the device ignores it and preselects a different domain instead. The setting requires UniconOS 2609 or later; earlier versions ignore it.

If you switch the authentication type, a previously set default domain stays stored and is still sent to the device, even though the new authentication type’s dialog has no field to show or clear it. To remove it, clear it before switching: empty the Imprivata field, or choose Remove default domain in the AD directory.

Logon screen information (Scout Board)

Scout Board can also show a device information tile on the sign-in screen itself, before the user signs in. Configure it in Device configuration > User authentication > Show information on the logon screen. For the full configuration reference, see Logon screen information in the UniconOS guide.

Locking a kiosk device with a local password

When Authentication type is None, UniconOS normally never locks a shared kiosk device: the idle timer fires, the screen blanks, and any mouse movement brings the session straight back. This feature lets such a device lock and require one administrator-set password to unlock — no username or domain is asked for. For what the lock screen looks like and how it behaves on the device, see Kiosk lock screen in the UniconOS guide.

Four existing triggers reach the lock screen once this feature is on:

The password is stored as a hash on the device. Scout never receives the password back — it only knows whether one has been set, not what it is.

Note:

This feature has no effect until the device is already running in kiosk mode (UC Self Service or UC Browser).

If the device has an Imprivata bootstrap URL configured, Imprivata’s own lock screen takes over instead, and this feature has no effect even when it’s turned on.

Configuring the kiosk lock screen

Set as Scout advanced INI entries on the OU, then restart the device — it only reads this configuration at startup.

To turn the feature off, set Kiosk lock screen back to false — the stored password isn’t deleted, so turning the feature back on later doesn’t require setting the password again. Clearing the password instead also stops the device from locking, but leaves the toggle showing the feature as on, which is misleading.

Note:

A kiosk application that holds a screensaver-inhibitor lock (for example a web page that calls navigator.wakeLock.request('screen')) blocks the idle timer from ever locking the device. The hotkey, the system menu entry, and the before-suspend lock are unaffected.