How passcode authentication works
A passcode is a system-generated code that users enter at a secured printer to sign in and release their print jobs. It gives users a reliable way to sign in when they can’t use a card, for example when their card is lost, damaged or left at home, or when a printer doesn’t have a card reader.
Why passcodes are used
When your organization uses OpenID Connect or SAML, users sign in through your identity provider, usually with single sign-on and multi-factor authentication. That works well on a computer or phone, but a printer’s control panel isn’t a practical place to enter a full set of credentials or complete a multi-factor prompt.
A passcode solves this. The user proves who they are once, through your identity provider, and HP Insights issues a short code that’s linked to their account. The user then enters that code at the printer instead of their identity provider password. Their password never has to be typed on a shared device.
Organizations typically use passcodes in one of two ways:
- As a fallback for users who normally tap a card, but occasionally don’t have it with them.
- As the main sign-in method at printers that don’t have a card reader, or in organizations that don’t issue cards.
How users get a passcode
Each user has one passcode at a time. HP Insights creates it using the rules you set, such as length and character complexity, and shows it only once, when it’s created. HP Insights doesn’t send passcodes by email, so users need to save their passcode somewhere safe, such as a password manager.
How a user receives their first passcode depends on what’s installed in your environment:
| Where | What happens |
|---|---|
| Print Scout | The first time a user signs in through Print Scout, a passcode is created automatically and shown once. Signing in again, or signing in on another workstation, doesn’t change an existing passcode. |
| User Portal | If the User Portal is turned on, users can generate a passcode there. This is useful in environments without Print Scout, such as cloud-only environments that use the Cloud Connector. See Generate a passcode. |
| HP Secure Print mobile app | When a user without a passcode signs in to the mobile app, the app prompts them to generate one. |
Users who forget or lose their passcode can reset it at any time from the HP Secure Print desktop app, the User Portal or the mobile app. Resetting creates a new passcode and replaces the old one, so the old passcode no longer works. See How to reset a passcode.
Where users enter a passcode
At a secured printer, users select the passcode sign-in option and enter their passcode to see and release their jobs. The printer must be set up with Printer Sign-In for this option to appear. See Releasing print jobs with a passcode.
Users can also enter their passcode at a printer to register a proximity card. After the card is registered, they can tap it to sign in from then on, and keep the passcode for the times they don’t have their card.
How passcode expiry works
You choose how long passcodes stay valid. A passcode that never expires is the most convenient for users, while a shorter lifetime limits how long a passcode is useful if someone else learns it. The right setting depends on how your organization uses passcodes:
- Never expires (default) suits organizations where the passcode is a long-term alternative to a card.
- Expires in 15 minutes suits single-use, short-term access. The user generates a passcode, uses it once at the printer and then forgets it. This reduces the risk of a long-lived passcode being reused or shared.
- Expires in a number of days balances convenience and security by making users replace their passcode regularly, much like a password policy.
When a passcode expires, the user can’t use it at a printer any more and needs to reset it to get a new one.
How expiry reminders work
If passcodes expire after a number of days, Print Scout and the HP Secure Print mobile app remind users before and after their passcode expires, so they can reset it before they’re stuck at a printer. Each reminder includes a Reset button that takes the user straight to generating a new passcode. In Print Scout, reminders appear at most once a day. The User Portal also shows a banner, following the same rules.
Some users rarely use their passcode and don’t want to be reminded about it. They can select Do not remind me again in the Print Scout reminder or in the HP Secure Print mobile app’s Reset Passcode prompt. This turns off reminders for their current passcode everywhere they use it, but the passcode still expires on schedule. Reminders start again when they reset their passcode.
Users can also turn on the same setting in the User Portal, with the Suppress passcode expiration reminders toggle on the Passcode page. It’s one preference for each user, not separate switches, so turning it on in Print Scout, the HP Secure Print mobile app or the User Portal stops reminders in all three. See Turn off passcode reminders in the User Portal.
Passcodes that never expire don’t need reminders, and passcodes that expire after 15 minutes are meant to be used once, so neither produces reminders. For the exact rules, messages and version requirements, see Passcode settings and limits.