Configure Papercut MFA and Azure AD for user-initiated badge association
I recently created a print server in Azure. The server is running PapercutMF and is syncing its user list from Azure AD using an App Registration.
We have a site-to-site VPN connection from the on-prem network to Azure with all subnets exported.
Issue
When a new user is onboarded, we want them to be able to take their new Mifare card and associate it with their account. This process we want is the following:
- Get new RFID badge from box and give to onboarding user
- User touches badge to Xerox RFID reader
- Xerox prompts user to type Azure AD email address and password
- Papercut MF associates this card number with the user's email address
Step 4 was failing, however, and the MFPs were showing an error message “Login Denied: Failed to associate card to account”:
Root cause
As explained by Papercut's support KB [A], the main issue with this workflow is that the Azure AD tenant that I created this workflow in uses Conditional Access to require MFA approval before authenticating user logins.
Papercut MF currently does not support MFA prompts and won't be able to process the login from the MFPs.
Remediation
To workaround the Conditional Access policy enforcing MFA, you need to add the print server's IP to the MFA exceptions at this link: https://account.activedirectory.windowsazure.com/usermanagement/mfasettings.aspx
You will need to add the IPv4 address of your VM or load balancer (if using VMSS) with a /32. You could also use the entire subnet:
After making that change, you can verify that this association is working by touching the badge to the reader, then logging in with Azure AD credentials. The logs on the Papercut MF dashboard at Logs > Application Logs will show a successful authentication:
Essentially, this is telling Azure AD to not require an MFA prompt when users authenticate through Papercut MF. The red herring was changing any settings related to the Papercut MF App Registration for user sync, as this does not appear to be related to user login authentication.
References: https://www.papercut.com/support/resources/manuals/ng-mf/common/topics/sys-user-group-sync-azure.html
