Print Roaming
Print Roaming – overview
Description
Print Roaming is an extension of pull-printing (print job after authentication at the MFD). With pull-printing, after user sends a job to a printer, user "pulls" the job to the printer — user goes to a printer, authenticates and prints the job. This feature brings several important advantages:
Flexibility: Users can send a print job and choose any MFD for pick up
Costs and environment: Reduced paper waste which results from printouts left at printers uncollected
Security: Users have to authenticate at the printer before documents are printed out
With both Print Roaming and pull-printing, users can release their print jobs at any printer which is connected to YSoft SafeQ system.
Print Roaming is one of the key needs of companies with multiple locations - users who move between the locations frequently need the ability to manage their print, copy and scan jobs without any additional changes in their habits. In practical terms - wherever the user is and needs to print, copy or scan, they can do so using combination of Print Roaming and Pull-Printing features of YSoft SafeQ.
Job roaming in the YSoft SafeQ Enterprise Distributed Server System - Private Cloud is built on top of ORS technology. Roaming is established among two or more ORS servers, acting as peers. Additional types of roaming, such as the transfer of print jobs to and from the CML server are not considered.

Job roaming is designed to meet the following requirements:
The user can pick up submitted print jobs at any device connected to YSoft SafeQ without any significant impact on the wait times.
The system administrator has an option to decrease system overhead by increasing waiting times before jobs are available in more distant locations.
Two print roaming modes are available: near roaming and far roaming. Because peers need to share certain types of information (in a group), an ORS can belong only to one roaming group (members of which have access to all jobs in the group much faster), configured by the system administrator. The system provide multiple near-roaming and far-roaming groups in order to support variety of environments.
Print Roaming within single server (LAN)
In organizations with one server, no additional configuration is needed. YSoft SafeQ provides print roaming, the ability to release the jobs, with all connected devices.
YSoft SafeQ does not modify print job data, so PDL-level compatibility between printers must be ensured by other means.
To configure this feature, see Configure secure printing and Print roaming.
Print Roaming with multiple servers within LAN (Near-roaming mode)
In organizations with multiple servers, each being hosted in its own location, near-roaming groups can be set up among the servers. This requires additional CPU power and network resources in order to allow fast synchronization of print jobs among the group peers without noticeable delays to end users. This roaming mode uses synchronization protocols which efficiently distribute job metadata among all members of the roaming group. Print job data are retrieved from the originating ORS on demand and are delivered to the device where user is standing (using ORS managing that particular device). This requires availability of the ORS servers, so that the information can be shared and delivered.
This is typically required in case of hundreds/thousands of users in a relatively small area on a high-speed, low-latency network (such as LAN or sometimes even buildings co-located in one city).
Read Configuring Print Roaming about more details on how to configure the system to allow this behavior.
Print Roaming with multiple servers within WAN (Far-roaming mode)
When company operates with several subsidiaries, even across mutliple continents, the users need the print/copy/scan services to be available at all times. Users may need to (re)print a job sent to the YSoft SafeQ after travelling a longer distance. Because of that, system administrators may consider decreasing network and CPU load, where users may notice delays (seconds to minutes, depending on the network and system configuration) before their jobs are available at devices connected to the destination ORS.
This roaming mode sends job metadata over main CML server and support for UDP multicasting is not required for standard operation. However, the infrastructure will still provide high-performance networking to minimize the delay to job availability. This mode of operation is more robust, but is useful in situations where only a fraction of the users requires roaming for their operations (such as travelling salesmen, etc.).
User Stories
Pull-print -- As a user, I want to print a document from my workstation and release it at the printer only after I authenticate there, so that I'm sure my documents remain confident.
Roaming-print (LAN) -- As a user, I want to print a document from my workstation and release it at any printer in my office (LAN proximity) after I authenticate there, so that I don't need to rely on the availability of only one printer.
Roaming-print (WAN) -- As a user travelling around company offices, I want to print a document from my notebook and release it at any printer in any office (WAN or VPN network) after I authenticate, so that I don't need to rely on the availability of only one printer and without needing to know the location of my print server or my default printer.
Requirements
The user can print a document from a workstation by using default printing methods; the system must keep the document on hold and not release it to the printer.
The user will be able to authenticate at the printer and request release of held print jobs to the printer.
The system will release only print jobs that are compatible with the target printer.
see example in the comments section.
Incompatible print jobs will not be available to the user (or the user will be informed about the incompatibility issue); this option will be configurable by the system administrator.
The user will be able to use secure print (pull-print) at every printer connected to the system network.
With a high-speed network, the user will be able to send a document to print from any workstation and release it at any printer, exactly as if using standard Print roaming, regardless of the number of involved servers or underlying architecture.
With a low-speed / low-latency network, the user will be able to send a document to print from any workstation and release it at any printer; however, if the originating system is "far" from the target printer, the system will synchronize data in the background and request that the user wait (for synchronization) or release the document later.
The YSoft SafeQ Web Interface will be modified so that the system administrator can create and modify roaming groups for near or far job roaming. The administrator will be able to completely disable roaming by setting an ORS to operate in standalone mode only.
Dependencies / non-functional requirements
YSoft SafeQ Server must be installed and available within LAN proximity. Secured-print works only in a LAN.
Each printer must be equipped with a terminal.
Print drivers must send print data to YSoft SafeQ server.
Identity management must be established (see User Identity management).
Distributed Server System - Private Cloud with a single central CML system must be established, with a server in every location required for near- or far- print roaming.
Global identity management (common for all YSoft SafeQ servers in the network) must be established.
No extensions in YSoft SafeQ Client or any other client tool is necessary. Job roaming may introduce additional pop-up messages to be handled by the default YSoft SafeQ Client facility for such messages.
The origin ORS and the destination ORS in a near-roaming group must be visible to each other on the network. The network must also provide the necessary bandwidth and low latency to eliminate any impact of the network on the availability of print jobs at destination ORSs. Without network visibility and performance, near-roaming mode does not produce correct results and cannot be used.
For near-roaming groups with more than 10 ORS servers, UDP Multicast must be enabled among servers!
Caveats
When using job roaming, note that you CANNOT roam jobs between CML and ORS.
For a near-roaming mode, it is recommended to to use fiber optics network.
When using an application-based failover system, if a server fails, all print jobs stored on the failed server are unavailable for release at terminals and users must re-submit the jobs from their workstations.
Shared network storage can solve this problem.
Pull-print may affect the speed of the print process (measured as time-to-print) under the following conditions:
YSoft SafeQ server is available on a 100MB LAN, complies with specifications, and CPU utilization is <10%.
User authenticates at the terminal, opens a job list, selects a print job, and selects Print.
Time is measured from that moment to the moment the printer starts to receive data.
With far-roaming mode,
When using the Job Roaming feature (enabled by the license), all ORS servers are automatically configured to FAR-roaming group. Far roaming also works among near-roaming groups and among near-roaming group and standalone ORS servers. It is not possible to limit job roaming to only selected ORS servers.
The following components of the YSoft SafeQ system must be online, configured (both mentioned ORSes are not in the same near-roaming group) and working properly: the CML, the ORS the prints will be sent to, the ORS the printer/MFD is connected to, the printer/MFD where the print job will be printed.
Users may notice delays (seconds to minutes, depending on the system configuration) in job availability at the terminals connected to the remote (other than origin of print) destination ORS, because ORS downloads information (metadata) about user's print jobs every 5 minutes (by default). When user logs on terminal connected to remote ORS for the first time, there is no delay in job availability.
Users may notice delays (depending on the size of the print job and a network speed) in printing (i.e. time from pressing print button on terminal to time when the first paper comes out from the printer/MFD), because print job data are downloaded from remote ORS on demand. Print job data are not synchronized. Only print job metadata are synchronized.
(NOTE: The User Roaming feature is usually required for Far/Global roaming features.
Comments
Time implications on print speed:
Configured options | SafeQ server | Time to Print |
HW Terminal Professional/UltraLight | CML | ~1 sec |
HW Terminal Professional/UltraLight | ORS | <10 sec |
Embedded terminal | CML | ~1-3 sec |
Embedded terminal | ORS | <5 sec |
Printer compatibility is defined based on the System Tags in YSoft SafeQ Administrative web interface. The tag represents the capability of the printer, such as PDL-compatibility (PCL, PostScript, ...) or feature such as Color, Duplex, Paper Size (Large/Small).
Example:
A3(Tabloid) Color Printer ... will display all A4(letter), A3(Tabloid), Monochrome and Color print jobs in the list.
A3(Tabloid) Mono Printer ... will display all A4(letter), A3(Tabloid), Monochrome and Color print jobs in the list, but will only allow release of Mono Print jobs.
A4(Tabloid) Color Printer ... will display all A4(letter), A3(Tabloid), Monochrome and Color print jobs in the list, but will only allow release of A4(Letter) Print jobs.
A4(Tabloid) Mono Printer ... will display all A4(letter), A3(Tabloid), Monochrome and Color print jobs in the list, but will only allow release of Mono A4(Letter) Print jobs.
Secured printing / Print roaming – diagram
This workflow is typically used for secured printing (pull-printing), Print roaming, YSoft Mobile Print Server.
User information is typically replicated from an LDAP server using a secured (server-authenticated) LDAP/S connection. This step is, however, purely optional. See Identity management for additional details.
The user prints the data from the workstation using the standard print mechanism. By default, the data are transferred via plain LPR protocol. Optional plain or encrypted data transfer is possible using YSoft SafeQ Client for Windows, OS X or Linux. The server stores the data in plain form on the disk folder. For more details, see YSoft SafeQ Security Overview document.
The user places/inserts the card and/or enters a PIN.
If PIN only or card ID verification is used, the information is transferred to YSoft SafeQ using the TLS-based secure protocol (with client-only authentication — the server verifies the identity of the terminal). The server looks up the internal SQL database to find the user record associated with the entered PIN or card ID.
If Smart Card Authentication via Terminal Professional is used, following communication occurs to YSoft SafeQ server using the TLS-based secure protocol (with client-only authentication — the server verifies the identity of the terminal).
(A) YSoft SafeQ server uses the Kerberos v5 protocol to get the Ticket Granting Ticket information (TGT) from the Kerberos server.
(B) Kerberos sends encrypted information back to the server.
(C) The server uses the secured connection with Smart Card to decipher the data.
(D) The Server gets the deciphered data and looks up the internal database for the respective user record.
If Smart Card Authentication occurs at MFD directly, than:
(A,B) The MFD verifies smart card directly with Active Directory using Kerberos protocol
(H) The MFD request a user session with SafeQ server based on Authenticated User's Subject ID.
YSoft SafeQ uses several methods to gather the accounting data (see Print tracking methods). If the online accounting method is used, the SNMP protocol is used to gather the current page meter information from the printer.
With vender-provided accounting, the accounting information is transferred to YSoft SafeQ from the printer via SOAP or HTTPS POST message.
Card / PIN based authentication

PKI (smart card-based) or login/password-based authentication via Terminal Professional

PKI (smart card-based) or login/password-based authentication via PIV USB Reader
Please note that this feature requires device to be equipped with PIV compliant smart card reader and provide user information via embedded terminal session.

Mobile printing
If mobile printing (YSoft Mobile Print Server) is used, only Print method (2) on the previous diagrams is different. The user does not deliver the data using described protocols; instead, the user sends the data via e-mail or uploads the data to the YSoft SafeQ Web.
If the e-mail method is used, the owner of the document is recognized by the FROM: email header. No further special security is enforced. If the user e-mail address is not known to the system, depending on the configuration, the server can send a registration link to the user. The user then uses his YSoft SafeQ credentials to log in to the page. Typically Kerberos authentication (3.a/3.b) is used.
If the Web upload method is used, the user must access the secured (server authentication only) Web page, log in using the same method as described in the previous point, and upload the document using the standard HTTP(S) upload form. Kerberos-based single-sign-on (SSO) is also available.
YSoft SafeQ uses Windows Authentication Framework (http://waffle.codeplex.com/documentation) for the SSO process.