Integrated Login
security365 unified login
- The unified login UI appears upon the first login.
- If you are not a unified login user, closing the unified login UI during the first login will display the Document Security login UI.
The SHIELD ID login screen can be applied as below with the DS365.Core.json settings.
DS_MIP_INITItem Settings
Specify "mode" as "webView" or "msedgeApp".
The options to be used in the login types "webView" and "msedgeApp" are set by the items of the corresponding key values.
The "title" specification designates the string displayed in the unified login UI. It is generally displayed as Security365, but if you change the unified login CI and title through customization, you must also apply this file accordingly.
//DS365.Core.json 설정 예제
{
"login": {
"port": "28080",
"waitMinTime": "0",
"mode": "msedgeApp",
"title": "Security365,SOFTCAMP,Shieldrm,Login",
"webView": {
"idPwEveryTime": "none",
"topMost": "none"
},
"msedgeApp": {
"fullScreen": "none",
"idPwEveryTime": "none",
"topMost": "none"
}
}
}
| User Screen | Content | Note |
|---|---|---|
 | Window Mode | login.mode : "msedgeApp" |
 | Full Screen Mode Displayed on the Main Monitor in Full Screen | login.mode : "msedgeApp", "login.fullScreen" : "use" |
security365 account linkage
- When logging in with SHIELD ID, if there is no document security account (SCI server) information registered for the account, the account linking will proceed as follows.
Each guide screen is3 minute timeoutThis will be applied, and if the notification window is not closed for 3 minutes, it will automatically close and move to the next step.
| User Screen | Content | Note |
|---|---|---|
| Integrated Login (SHIELD ID) | microsoft id/pw authentication |
 | Display a notification window if there is no sci account linked to the completed SHIELD ID after proceeding with the unified login. | If there is no connected information, attempt the following items under the SHIELD ID authenticated ID: 1. Check the user on the sci server with the full account information 2. Check the user on the sci server after removing the domain information |
 | Follow the document security login procedure. | If document security login is in progress and there is no automatic login/SSO, the document security login screen will be displayed, and after completing the document security login, you will move to the screen below. |
 | Output of account information that has successfully passed SHIELD ID and document security authentication and connection guidance screen | After logging in, if the SHIELD ID of the document security account and the already issued token do not match, the existing token will be deleted, and the account linked to the SHIELD ID will be registered as the currently logged-in document security account. This may occur in cases where multiple users log in to the same device, such as a meeting room. |
 | Completion Notification Screen for Registering sci Users in SHIELD ID |
Customizing the SHIELD ID Unified Login Page
- To set up the screen for the site, it is necessary to configure the relevant policies in the idp service.
- Reference| ⚠️ This document is restricted access material.
- Need to set the value of the extra policy in the DS_MIP_INIT policy.
- Policy Example
{
"s365_url": "https://devlogin.softcamp.co.kr/",
"s365_app_id": "4e3b53b2-a18c-4d78-8de1-b9fcada4077c",
"s365_app_name": "shieldrm-svc",
"s365_app_secret": "JyktLCInJ------------------------JycsJyQ",
"s365_log_url": "https://log.security365.com/log/event",
"shieldrm_url": "https://ssevtr.softcamp.co.kr/",
"extra": "3CJ55MSE-xLO7Sxt4-qUBKzbcs-XP2cgGEq",
"tid" : "4d615af9-1d04-4bcc-8e6f-c6b6fe3110dd",
"runMode": "s365"
}
Integrated Login Screen Popup On/Off Setting
info
This explains the feature to turn the integrated login screen popup On/Off through settings or custom policies.
Overview
- This is a feature that allows you to turn the integrated login screen popup on/off through settings or custom policies.
Explanation
- 'SHIELD DRM Not Used' is an option that the user can select directly, and the default value is
0is.\
DS_SDSENV_NOT_USE_SHIELD_DRMThe policy is a policy used by administrators to control this option centrally.- If this policy is used, the 'SHIELD DRM Disabled' checkbox on the settings screen will be disabled, and the user will not be able to change this option.
- The check status is forcibly applied according to the policy value set by the administrator, and user settings are ignored.\
Related Custom Policies
| ID | DS_SDSENV_NOT_USE_SHIELD_DRM |
|---|---|
| TYPE | Check On/Off |
| Description | SHIELD DRM Usage (1: Not Used, 0: Used) |
| Policy Value | 1 (or Check) |
| scsc | DS_SDSENV_NOT_USE_SHIELD_DRM.scsc |
Application Method
- Module Patch
- Custom Policy Settings and Fetching Policies
Constraints
- If the Shield Drm usage policy value is changed to an unused policy value, a system reboot must be performed for the related module to terminate normally and the function to be turned off.
- Even when changing from unused to used, it can operate without rebooting, but a reboot is recommended if possible.
- A user notification message appears stating that a system reboot is required when changing the corresponding value in the settings.
SHIELD ID User Account Deactivation Blocks DS6 Authentication and Logs Out
info
If the user account of SHIELD ID is deactivated, SHIELD ID authentication will fail in the DS6 client, and at this time, the existing SCI server authentication will also be blocked (login failure processing).
Overview
- When a user account is deactivated in SHIELD ID, the DS6 client blocks the authentication of that user and displays a notification message before processing a document security logout.
Explanation
- security365 User Deactivation
- Disabled users will experience the blocking action in the following two situations.
- Document Security Login Status
- If a user is deactivated due to actions evaluated by the ztcap policy (e.g., right-click MIP for document conversion, MIP->Drm document conversion, etc.), a notification message window will appear and the document security logout status will be activated.
- Document Security Not Logged In
- In the case of using the Runmode sso of the DS_MIP_INIT policy, before receiving s365 authentication, if the user is inactive when queried with the ShieldID, a notification message window will appear immediately after login, and the user will be logged out again.
- For values of Runmode policy other than sso, current support is not available (refer to the constraints below for reasons).
- Document Security Login Status
Application Method
- Module Patch
Constraints
- When using a Runmode other than sso for the DS_MIP_INIT policy (s365, appauth, aad, ds), the functionality to block login for ShieldID users who are deactivated and the immediate logout feature after login cannot operate for the following reasons.
- s365, in the case of ds, uses a unified login window to perform s365 authentication, and since the user's shieldID is authenticated on the browser and securiy365 front end, there is no way to obtain the ShieldID from the perspective of the DS 6.0 client. (Without the ShieldID, it is not possible to check whether it is disabled.)
- In the case of appauth, it operates based on the shieldrm svc app rather than individual users' shieldId, so the functionality is meaningless.
- In the case of aad, currently, you can obtain the shieldID from the token after authenticating with the tenant id, but it is not supported in the current structure.
- In the case of MIP release, there is no existing logic to determine the release status using ztcap, so this feature is not applied in the current structure.
Notification message
- If the user is deactivated, the document security will be logged out with the following notification message.
Related Custom Policies
- DS_MIP_INIT policyofForceLogoutOnUserDisabledThe document security logout feature for inactive users can be toggled On/Off with a policy value.
PKCE Authentication (Public Client Login)
info
Summary: App Secret in Policy (s365_app_idIf this is not present, it will automatically operate in PKCE (browser) login mode. The issued tokens are securely stored in the PC credential manager, used offline before expiration, and automatically renewed upon expiration.
Overview
The Security365 login of DS6 depends on the deployment environment.PKCE (Public Client) MethodThis is a feature that supports automatic operation.
You can complete user authentication with just browser login even in environments where app secrets (credentials) cannot be distributed, and then use Security365 features such as document security classification and MIP protection.
Users do not choose the authentication method themselves.**The method is determined automatically by the administrator policy settings.**and after authentication, you can use the features without re-logging in while the stored token is valid.
The reason this feature is needed
- The existing Confidential method is app secret (
s365_app_idThis policy must be deployed to function. In public client environments where it is difficult to deploy secrets, logging in was not possible. - Also, there have been cases where the login window does not appear when attempting MIP conversion (level change·protection) without authentication information, causing the operation to not proceed.
- This feature adds PKCE standard (public client) login and has been adjusted to ensure that the re-authentication window is displayed correctly in transformation requests in an unauthenticated state.
Operation Method
App Secret of the Policy(s365_app_id) Presence or absencePKCE / Automatic branching for ConfidentialAnd, in PKCE, user tokens are issued through browser login and stored in the credential manager, leading to automatic renewal or re-login upon expiration.
Scope / Entry Point
| Entry Point | Action |
|---|---|
| First Use of Security365 Features | Browser login window output → Token issuance |
| Right-click on the file → Change security level | Use save token, re-authenticate if necessary (after online verification) |
| Right-click on the file → MIP Protect/Unprotect | Use stored token, re-authenticate if necessary |
| Document Security (DS) Non-Login Status | MIP right-click menu is not displayed — see limitations |
Token Lifetime and Reauthentication
DS6 uses two types of tokens. User tokens are used for performing tasks, and refresh tokens are used for reissuing access tokens.
| situation | Action | User Intervention |
|---|---|---|
| R1. Access Token Expiration | Automatically reissue with refresh token to the server quietly (requires online) | None (Login window not displayed) |
| R2. Refresh Token Expiration/Invalidation | If in progress, automatically re-display the browser login window; if in the background, re-authenticate at the execution time. | Re-login |
| R3. Tenant (Company) Change | Require Re-login After Token Revocation (Prevent Cross-Tenant Abuse) | Re-login |
R4. Account Deactivation (User is not enabled) | Immediately fail without repeatedly displaying the login window. | Request Account Activation to Administrator |
Policy / Settings
| Settings Items | Location | value / description | Essential |
|---|---|---|---|
s365_app_id s365_app_secret | Server PolicyDS_MIP_INIT | If empty, PKCE; if filled, Confidential | Method Selection |
s365_pkce_appid | Server PolicyDS_MIP_INIT | PKCE Client ID (Priority) | recommended |
login.pkce-clientId | DS365.Core.json | PKCE Basic Client ID.s365_pkce_appidUsed when not set. Can be replaced by environment without redistribution. | s365_pkce_appidRequired when not in use |
warning
Warning:s365_pkce_appid(Server Policy) andlogin.pkce-clientIdIf the configuration file is empty, you cannot log in because there are no built-in defaults. One of the two must be set.
Configuration File Example (DS365.Core.json):
{
"login": {
"pkce-clientId": "9586b6e7-7f17-4d18-871b-051705bd5eb6",
"title": "SOFTCAMP,Security365"
}
}
Operation Scenario
| situation | result |
|---|---|
| First Use (Online) | Browser Login → Token Issuance·Storage |
| Save token valid | Immediate use without communication (including offline) |
| Access Token Expiration (Online) | Automatic Renewal, Window Not Displayed |
| Access Token Expiration (Offline) | Cannot renew → Online required |
| Refresh Token Expiration (Online) | Browser Re-login |
| DS Mi-login / Re-authentication required in offline status | Network Error Notification, Window Not Displayed |
| Account Deactivation | Immediate failure, administrator action required |
Constraints
| # | Restriction | Detail |
|---|---|---|
| C1 | Online required for initial use and token renewal | Server communication is required for browser login and automatic renewal. |
| C2 | Available for offline use with valid tokens | Offline operation before the storage token expires |
| C3 | Re-login when the refresh token expires | Automatic renewal not possible → Browser re-authentication |
| C4 | Re-login when changing tenant | Discard storage token in case of company mismatch |
| C5 | Admin Actions When Account is Inactive | Re-authentication window not displayed, account activation required |
| C6 | DS Login Prerequisites | The MIP conversion menu is only displayed when logged in to document security. |
| C7 | login.titleConfiguration Required (Operation) | If not set, the login window will not close and will be canceled after about 10 seconds. |
| C8 | shieldrm-svcServer registration required | Unregistered Grade Inquiry · MIP Blocking |
| C9 | PKCE Client ID must be set in at least 1 place. | s365_pkce_appidorlogin.pkce-clientIdOne or more required, otherwise login is not possible. |