Overview

Authentication is the act of validating that users are who they claim to be. The most common and simplest example of authentication is using a username and password to access an application.

This article describes how to enable authentication. In addition, this document provides steps for configuring Print Portal to automatically sign on by using Windows credentials.

Applicable to

BarTender Print Portal

BarTender 2021

Enterprise Edition only for BarTender 2022 and later 

Information

Enabling Authentication

By enabling authentication, we can protect our Print Portal website from anonymous access. Anyone who wants to access the web application will first have to go through to the login page where they can enter their credentials. 

To restrict website access by authorization:

1. Access the Print Portal web page and click on the Administrative Setup hyperlink on the top right corner in the navigation menu.
2. Under the Advanced property > Security, click to select the Enable Authentication check box.
3. Once enabled, the Sign In form will be served before access to home page both when using HTTP and HTTPS connections to the Print Portal.

Setting up Single Sign-On Using Active Directory With ADFS

In addition to the user authentication, you can also use Single Sign-On to automatically authenticate your users into the Print Portal web page. Single sign-on (SSO) authentication (with ADFS) is now supported in BarTender 2021 and later.

Active Directory Federation Services (ADFS) is a single sign-on solution developed by Microsoft. The AD FS role service can be installed on Windows Server operating systems. You can set up single sign-on using ADFS to provide your company’s clients, partners or vendors access to multiple resources throughout the organization, (e.g. BarTender Print Portal) with one set of login (username and password) and without being prompted for additional credentials.

This multi-part guide will walk you through configuring single-sign-on using Microsoft ADFS to allows users access Print Portal with a single login.

It is broken down into the following parts:

• Part 1 - Requirements
• Part 2 - Turn on Windows authentication IIS feature in Windows
• Part 3 - Enabling Windows authentication in IIS
• Part 4 - Register Print Portal with AD FS
• Part 5 - Editing the Print Portal Configuration File

Part 1 - Requirements

Before starting you need to install and deploy the AD FS service role on your server. However, please note that configuring and installing ADFS is beyond the scope of this guide.

Make sure that the BarTender Print Portal website uses HTTPS connection. An HTTP binding will not work. ADFS requires that the relying party trust, from where it can expect requests to come from, uses a secure URL. For more information on how to enable HTTPS in Print Portal, click here.

Part 2 - Turn on Windows authentication IIS feature in Windows

For security reasons, the Windows Authentication feature in IIS is turned off by default. To enable
this feature, follow these steps in Windows:

1. Right-click the Start button, then click Control Panel.
2. Under Control Panel>Programs and Features, click Turn Windows features on or off.
3. Under Internet Information Services>World Wide Web Services>Security, select Windows Authentication.

Part 3 - Enabling Windows authentication in IIS

1. Hit Windows key and type Run. 
2. In the Search box, type "inetmgr" and press ENTER.
3. In the Internet Information Services (IIS) Manager under Connections>[your Print Portal Server name]>Sites>Default Web Site>BarTender, double-click the Authentication icon from the BarTender Home page.

1. Use the Actions menu (right pane) to make the following changes:
   • Set Anonymous Authentication to Disabled.
   • Set Windows Authentication to Enabled.

Part 4 - Register Print Portal with AD FS

1. Run the AD FS Management console and open the server's Add Relying Party Trust Wizard.
2. Select the Enter data about the relying party manually option. 
3. Click Next.

4. Enter a display name for the relying party (e.g. Print Portal Login). 
5. Click Next.
6. Do not set an encryption token and click Next.
7. Enable support for WS-Federation Passive protocol, and then enter the root URL of Print Portal as the relying party protocol URL.  The relying party URL should be the URL where AD FS sends the SAML response after authenticating the user. 
8. Click Next through the rest of the wizard and Close at the end.

9. In the left pane of the AD FS Management console, select Relying Party Trusts.
10. In the center pane, select the relying party trust that you created for Print Portal.
11. Next, in the right pane, click Edit Claim Issuance Policy.

12. In the Add Transform Claim Rule Wizard, leave the default Send LDAP Attributes as Claims template selected, and click Next.
13. Select Add Rules from the Edit Claim Rules dialog.
14. Add a rule mapping the SAM-Account-Name LDAP attribute to the Name ID outgoing claim. 
15. Click Finish.

Part 5 -Editing the Print Portal Configuration File

Stop the application pool:

1. Open the IIS Manager.
2. In the Connections pane, expand the server node and click Application Pools to display all Application Pools.
3. On the Application Pools page, select the BPP_AppPool.
4. Click Stop to stop the application pool.
5.  

1. Make sure that the website is configured to use an HTTPS binding (See above - Part 1 - Requirements).
2. Edit the application's settings.xml file:
   1. Go to the main BarTender Print Portal Installation Folder. By default is is:

      C:\inetpub\wwwroot\BarTender

   2. Find and open the file the settings.xml.
   3. Edit the file as follows:
      • In the Authentication node, make sure that Enabled is set to true.
      • Change Mode to ADFS.
      • Provide the metadata address that corresponds to the ADFS server:

• • • Enter the root Print Portal URL in the RelyingPartyURL field. This URL must exactly match the URL that you configured in the AD FS Add Relying Party Trust wizard.

3. Start the BPP_AppPool application pool.

More Information

If you are using Mozilla Firefox as your browser, you need to make a configuration change to automatically pass Windows credentials. For more information, click here.