Single Sign-On (SSO)

Single sign-on (SSO) lets users access PaperCut NG/MF without needing to re-enter their username and password each time. Depending on your setup, users can sign in through trusted identity providers like Microsoft or Google, or via your organization’s existing web-based SSO system such as Integrated Windows Authentication (IWA).

SSO can also work alongside two-factor authentication, so users can confirm their identity using a code, fingerprint, or ID card. In some environments, passwords are managed entirely by your organization’s security system, making traditional PaperCut login unavailable—SSO ensures users can still access PaperCut NG/MF securely and seamlessly.

OAuth SSO methods

You can enable buttons like Sign in with Google or Sign in with Microsoft to streamline access and reduce password prompts. These one-click buttons can be visible in the user and admin login screens, the Print Deploy Client window, and the Mobility Print client window (Google-only).

• Sign in with Google – Use Google Workspace accounts for web login.
• Sign in with Microsoft – Use Entra ID (Azure AD) accounts for web login.

Web SSO methods

PaperCut NG/MF can use browser-based SSO to streamline login to the User and Admin web pages, whether they access the server directly or through a portal. These options are not available for the Print Deploy or the Mobility Print clients.

• Integrated Windows Authentication (IWA) – Automatically signs in users using Windows domain credentials.
• WebAuth – A web authentication system developed by Stanford University, implemented as an Apache module. No longer supported as of August 31, 2018.

NG/MF compatibility with SSO

How do different PaperCut NG/MF features support SSO

Single sign-on (SSO) can mean slightly different things across the PaperCut NG/MF ecosystem. Here’s how it works with each feature.

User and Admin Web Login

Several methods exist to enable SSO for the user and admin web interfaces, including Sign in with Microsoft, Sign in with Google, and web-based SSO methods like Integrated Windows Authentication (IWA).

Print Deploy Client

Print Deploy supports one-click Sign in with Microsoft and Sign in with Google. Print Deploy can also use Trust authentication, where the user is automatically signed in based on their Windows or macOS login — no username or password required. For general Print Deploy authentication info, see Print Deploy Auth methods .

Mobility Print Client

Currently, Sign in with Google is supported for Mobility Print while Sign in with Microsoft is not. For more details, see Authentication with Mobility Print and NG/MF .

PaperCut User Client

The PaperCut User Client (used for balance display, client billing, and notifications) can automatically recognize the currently logged-in operating system user. This means users typically don’t need to sign in manually — see PaperCut User Client Authentication .

Because of this automatic detection, the User Client doesn’t support OAuth-based SSO buttons (Google or Microsoft). The client can also be configured to sign in users from third-party applications — see Integrating the PaperCut Client with a Public Kiosk solution .

Embedded Devices

In this context, SSO usually refers to a customer’s ability to sign into a copier using their PaperCut credentials or swipe card, which then potentially allows them to access 3rd party features and apps. This is a wholly different process that varies between brands, models, and application. See Single Sign On for Embedded Devices .