Local Multi-domain Environments (Active Directory)

A MyQ X installation can synchronize and authenticate users from multiple Active Directory domains.

Because the same sAMAccountName can exist in different domains, users must be represented in MyQ with identities that remain unique across all synchronized domains. MyQ must also be able to determine the correct domain when assigning incoming print jobs.

Synchronize Users from Multiple Domains

Create a separate LDAP synchronization source for each Active Directory domain that supplies users to MyQ. For the synchronization procedure, see the Active Directory synchronization documentation in MyQ X Server.

Keep Usernames Unique

When synchronizing users from multiple domains, enable Append the domain name to the username for each relevant LDAP synchronization source.

Instead of:

john.doe

MyQ stores a domain-qualified username such as:

john.doe@atlanta.example.com

The appended domain is taken from the authentication server associated with the synchronization source.

For example, if two domains both contain a user with the sAMAccountName john.doe, MyQ can distinguish them as:

john.doe@atlanta.example.com
john.doe@phoenix.example.com

This prevents users with identical usernames in different domains from being treated as the same MyQ user.

Match Print Jobs to the Correct Domain

After domain-qualified usernames are created, incoming jobs must contain enough information for MyQ to identify both the user and their domain.

The identity information available in a print job depends on the print driver. Test the same driver vendor, model, and version that will be deployed to users.

To inspect the job:

Send a test job to MyQ from a computer in the relevant domain.
On the Print Server, open the job storage folder. The default location is:

C:\ProgramData\MyQ\Jobs

If a different job folder is configured in MyQ Easy Config, use that location instead.
Find the corresponding .prn file.
Open the file and check whether the user's domain is present in the print data.

If the domain is available, configure MyQ to extract it so that the resulting identity matches the domain-qualified MyQ username.

Configure Multi-Domain Job Detection

To let MyQ distinguish users with the same username in different domains:

Make sure Append the domain name to the username is enabled for each relevant LDAP synchronization source.
In C:\ProgramData\MyQ\config.ini, add:
```
[ExtraFeatures]
multipleDomains=1
```
Save the file and restart the MyQ services using Easy Config.

Then configure how MyQ detects the domain in incoming print jobs.

Use the Default PJL Domain Information

Some print drivers include the Windows domain in the PJL header.

For example:

@PJL COMMENT="USERDOMAIN:CustomerDomain.com"

If the driver provides the domain in this format, MyQ can use it together with the detected username to assign the job to the corresponding domain-qualified user.

Configure Custom PJL Detection

If the print driver does not populate:

@PJL COMMENT="USERDOMAIN:CustomerDomain.com"

but includes the domain elsewhere in the PJL header, configure the queue to extract it from the available field.

Go to MyQ > Queues and open the queue used by these users.
In the Job Receiving settings, configure PJL Detection to identify the domain from the appropriate PJL command.
Specify the regular expression used to extract the domain value.
If necessary, configure PJL Detection for the username or other job properties in the same way.

Test the configuration with each print-driver family used in the deployment. Different drivers can use different PJL fields or formats.

Verify Job Ownership

After configuring multi-domain detection, test a user from each domain.

Where possible, include users with the same sAMAccountName in different domains. Confirm that:

each user exists in MyQ with the expected domain-qualified username,
the incoming job contains the expected domain,
MyQ assigns the job to the correct user,
a user with the same username in another domain cannot access the job.

Repeat the test for each print-driver family used in the deployment.

Authentication

Configure the appropriate Active Directory authentication server for users from each domain.

The authentication domain and the identity stored for the user in MyQ should be consistent with the domain-qualified username created during synchronization.

For authentication planning, see:

Legacy User Detection Script

For MyQ X 10.1 and earlier, multi-domain job detection can be implemented using a custom PHP user-detection script. This method is legacy. For current MyQ X versions, use the multi-domain and PJL Detection configuration described above.

For the legacy configuration procedure and downloadable script, see Local Multi-domain Environments (Active Directory).

See also: