Docbox integrates with your organisation's Active Directory (AD) server to handle user authentication and printer access control. This article explains how that integration works and what your IT team needs to set up in AD before Docbox goes live.

Active Directory integration is optional. If your organisation does not use AD, users can be managed directly within Docbox using local accounts.

How Docbox uses Active Directory

Docbox connects to your AD server using the LDAP or LDAPS protocol to do the following:

Authentication

When a user logs in to the Docbox Dashboard or Print Driver, Docbox authenticates them against your AD server. Any user with a valid AD account can log in, but they will not be able to submit print jobs unless they have been granted access to at least one printer.

Printer access control

Docbox printers are not registered as printers in Active Directory Domain Services and are not managed through standard AD printer management tools. Instead, each Docbox printer is linked to an AD group using that group's LDAP distinguished name. Users are granted access to a printer simply by being added to the corresponding AD group using your normal AD administration tools.

This means that once your Docbox printers are configured, all day-to-day user and access management is handled in AD — there is no need to make changes in Docbox itself when users join, leave, or change roles.

Reporting access

Docbox supports two levels of elevated reporting access, both controlled via AD group membership:

• Users in a designated departmental reporting group can view print jobs for all users within their department.
• Users in a designated organisational reporting group can view and report on all print jobs across the organisation.

Both are optional. If neither group is configured, users can only view their own print jobs.

Control Panel access

Access to the Docbox Control Panel is also managed via AD group membership. See LDAP Roles for details of the available roles and how to configure them.

Setting up AD for Docbox

Before configuring the LDAP integration in the Control Panel, your IT team will need to have the following in place in Active Directory:

Service Account

Create a dedicated AD account for Docbox to use when connecting to your directory. Grant this account read-only permissions. Docbox does not and will not modify any data in your AD server, but a dedicated read-only account is recommended as best practice.
 

Printer access groups

Create an AD group for each Docbox printer (or set of printers) you intend to configure. The group name can follow your organisation's existing naming conventions. You will need the LDAP distinguished name of each group when configuring printers in the Control Panel.

Reporting groups (optional)

If you wish to use departmental or organisational reporting, create the relevant AD groups and note their LDAP distinguished names.

Roles groups (optional)

if you wish to control Control Panel access via AD, create groups for the relevant roles. See LDAP Roles for the full list of available roles.

Once AD is prepared, configure the connection in the Control Panel under LDAP Settings. See LDAP Settings for guidance.

Known Limitations

Be aware of the following limitations before configuring your AD integration.

Domain Users group

The Domain Users group is not visible to Docbox over LDAP/LDAPS. Docbox cannot retrieve the membership of that group or recognise it when viewing a user's group memberships. Users can be members of any other AD group without issue.

Nested group membership

Docbox does not currently support nested printer groups. If a user needs access to three printers, they must be added directly to each printer's AD group. It is not possible to create a parent group containing all three printer groups and add the user to that parent group instead.

Data usage

When AD integration is enabled, Docbox retrieves the following information from your directory for each authenticating user: 

• basic user profile data:
  • name
  • LDAP distinguished name
  • department
  • email address
• group membership to determine whether the user has access to any named printer and/or reporting groups you have configured

This information is used solely within the Docbox platform and is not transmitted to any external system.