Integrated Login
security365 unified login
- The unified login UI appears upon first login.
- If you are not a unified login user, closing the unified login UI during the first login will display the Document Security login UI.
The SHIELD ID login screen can be applied as follows using the DS365.Core.json configuration.
DS_MIP_INITItem Settings
Specify "mode" as "webView" or "msedgeApp".
The options to be used in the login types "webView" and "msedgeApp" are set by the items of the corresponding key values.
The "title" designation specifies the string displayed in the unified login UI. It is generally displayed as Security365, but if you customize the unified login CI and title, you must also apply this file accordingly.
//DS365.Core.json 설정 예제
{
"login": {
"port": "28080",
"waitMinTime": "0",
"mode": "msedgeApp",
"title": "Security365,SOFTCAMP,Shieldrm,Login",
"webView": {
"idPwEveryTime": "none",
"topMost": "none"
},
"msedgeApp": {
"fullScreen": "none",
"idPwEveryTime": "none",
"topMost": "none"
}
}
}
| User Screen | Content | Note |
|---|---|---|
 | Window Mode | login.mode : "msedgeApp" |
 | Full Screen Mode Displayed on the Main Monitor in Full Screen | login.mode : "msedgeApp", "login.fullScreen" : "use" |
security365 account linkage
- When logging in with SHIELD ID, if there is no document security account (SCI server) information registered for that account, the account linking will proceed as follows.
Each guide screen is3 minute timeoutThis will be applied, and if the notification window is not closed for 3 minutes, it will automatically close and proceed to the next step.
| User Screen | Content | Note |
|---|---|---|
| Integrated Login (SHIELD ID) | microsoft id/pw authentication |
 | If there is no sci account linked to the completed SHIELD ID after proceeding with the unified login, display a notification window. | If there is no connected information, attempt the following items under the successfully authenticated SHIELD ID: 1. Check user on the sci server with full account information 2. Check user on the sci server after removing domain information |
 | Follow the document security login procedure. | If there is no automatic login/SSO for document security, the document security login screen will be displayed, and after completing the document security login, you will move to the screen below. |
 | SHIELD ID and document security authentication successful account information output and connection guide screen | After logging in, if the SHIELD ID of the document security account and the already issued token are different, the existing token will be deleted and the account linked to the SHIELD ID will be registered as the currently logged-in document security account. This may occur in cases where multiple users log in to the same device, e.g., conference rooms. |
 | Completion Notice Screen for Registering sci Users in SHIELD ID |
Customizing the SHIELD ID Unified Login Page
- To set up the screen for the site, it is necessary to configure related policies in the idp service.
- Reference| ⚠️ This material is restricted in access.
- Need to set the value of the extra policy in the DS_MIP_INIT policy.
- Policy Example
{
"s365_url": "https://devlogin.softcamp.co.kr/",
"s365_app_id": "4e3b53b2-a18c-4d78-8de1-b9fcada4077c",
"s365_app_name": "shieldrm-svc",
"s365_app_secret": "JyktLCInJ------------------------JycsJyQ",
"s365_log_url": "https://log.security365.com/log/event",
"shieldrm_url": "https://ssevtr.softcamp.co.kr/",
"extra": "3CJ55MSE-xLO7Sxt4-qUBKzbcs-XP2cgGEq",
"tid" : "4d615af9-1d04-4bcc-8e6f-c6b6fe3110dd",
"runMode": "s365"
}
Integrated Login Screen Popup On/Off Setting
info
This describes the feature that allows you to turn the integrated login screen popup On/Off through settings or custom policies.
Overview
- This is a feature that allows you to turn the integrated login screen popup on/off through settings or custom policies.
Description
- 'SHIELD DRM Not Used' is an option that the user can select directly, and the default value is
0is.\
DS_SDSENV_NOT_USE_SHIELD_DRMThe policy is a policy used by administrators to control this option centrally.- If this policy is used, the 'SHIELD DRM Not Used' checkbox on the settings screen will be disabled, and the user will not be able to change this option.
- The check status is forcibly applied according to the policy value set by the administrator, and user settings are ignored.\
Related Custom Policies
| ID | DS_SDSENV_NOT_USE_SHIELD_DRM |
|---|---|
| TYPE | Check On/Off |
| Description | SHIELD DRM usage (1: Not used, 0: Used) |
| Policy Value | 1 (or Check) |
| scsc | DS_SDSENV_NOT_USE_SHIELD_DRM.scsc |
Application Method
- Module Patch
- Custom Policy Settings and Fetching Policies
Constraints
- If the Shield Drm usage policy value is changed to an unused policy value, the system must be rebooted for the related module to terminate normally and the function to be turned off.
- Even when changing from unused to used, it can operate without rebooting, but rebooting is recommended if possible.
- When changing the corresponding value in the settings, a user notification message appears indicating that a system reboot is required.
Disabling SHIELD ID user account blocks DS6 authentication and logs out.
info
If the user account of SHIELD ID is deactivated, SHIELD ID authentication will fail on the DS6 client, and at this time, existing SCI server authentication will also be blocked (login failure processing).
Overview
- When a user account is deactivated in SHIELD ID, the DS6 client blocks the authentication of that user and displays a notification message before processing a document security logout.
Description
- security365 User Deactivation
- Inactive users will experience blocking actions in the following two situations.
- Document Security Login Status
- If a user is deactivated due to actions evaluated by the ztcap policy (e.g., right-clicking to convert documents with MIP, converting MIP to DRM documents, etc.), a notification message window will appear, and the document security logout status will be activated.
- Document Security Not Logged In
- In the case of using the Runmode sso of the DS_MIP_INIT policy, before receiving s365 authentication, if the user is inactive, a notification message window will appear immediately after login, and the user will be logged out again.
- For values of Runmode policy other than sso, support is currently unavailable (refer to the constraints below for reasons).
- Document Security Login Status
Application Method
- Module Patch
Constraints
- When using a Runmode other than sso for the DS_MIP_INIT policy (s365, appauth, aad, ds), the functionality to block login for ShieldID users who are deactivated and to log out immediately after login cannot be executed for the following reasons.
- s365, in the case of ds, uses a unified login window to perform s365 authentication, and since the user's shieldID is authenticated on the browser and securiy365 front end, there is no way to obtain the ShieldID from the perspective of the DS 6.0 client. (Without the ShieldID, it is impossible to check whether it is inactive.)
- In the case of appauth, it operates based on the shieldrm svc app rather than individual users' shieldId, making the functionality meaningless.
- In the case of aad, currently, you can obtain the shieldID from the token after authenticating with the tenant ID, but it is not supported in the current structure.
- In the case of MIP release, there is no existing logic to determine the release status using ztcap, so this functionality is not applicable in the current structure.
Notification Message
- When the user is deactivated, the document security logout is processed with the following notification message.
Related Custom Policies
- DS_MIP_INIT policyofForceLogoutOnUserDisabledThe document security logout feature for inactive users can be toggled On/Off with a policy value.
PKCE Authentication (Public Client Login)
info
Summary: App Secret in Policy (s365_app_idIf this is not present, it will automatically operate as PKCE (browser) login. The issued token is securely stored in the PC credential manager, can be used offline before expiration, and is automatically renewed upon expiration.
Overview
The Security365 login of DS6 depends on the deployment environment.PKCE (Public Client) MethodIt is a feature that supports automatic operation.
You can complete user authentication with just browser login even in environments where app secrets (credentials) cannot be distributed, and then use Security365 features such as document security classification and MIP protection.
Users do not choose the authentication method themselves.**The method is determined automatically by the administrator policy settings.**and, after authentication, you can use the features without re-logging in as long as the stored token is valid.
Reason for Needing This Feature
- The existing Confidential method is app secret(
s365_app_id) This policy must be deployed to function. In public client environments where it is difficult to deploy secrets, logging in was not possible. - There have also been cases where the login window does not appear when attempting MIP conversion (level change·protection) without authentication information, preventing the operation from proceeding.
- This feature adds PKCE standard (public client) login and ensures that the re-authentication window is displayed correctly in transformation requests in an unauthenticated state.
Operation Method
App Secret of the Policy(s365_app_id) Presence or absencePKCE / Automatic Branching for ConfidentialIn PKCE, the user token is issued through browser login and stored in the credential manager, leading to automatic renewal or re-login upon expiration.
Scope / Entry Point
| Entry Point | Action |
|---|---|
| Using Security365 Features for the First Time | Browser login window output → Token issuance |
| Right-click on the file → Change security level | Use saved token, re-authenticate if necessary (after online verification) |
| Right-click on the file → MIP Protect/Unprotect | Use saved token, re-authenticate if necessary |
| Document Security (DS) Non-Login Status | MIP right-click menu is not displayed — see limitations |
Token Lifetime and Reauthentication
DS6 uses two types of tokens. The user token is used for performing tasks, and the refresh token is used for reissuing access tokens.
| situation | Action | User Intervention |
|---|---|---|
| R1. Access Token Expiration | Automatically reissue with refresh token to the server quietly (requires online) | None (Login window not displayed) |
| R2. Refresh Token Expiration/Invalidation | If in progress, automatically re-display the browser login window; if in the background, re-authenticate at the time of execution. | Re-login |
| R3. Tenant (Company) Change | Require Re-login After Token Revocation (Prevent Cross-Tenant Abuse) | Re-login |
R4. Account Deactivation (User is not enabled) | Immediately fail without repeatedly displaying the login window. | Request Account Activation to Administrator |
Policy / Settings
| Settings Item | Location | value / description | Required |
|---|---|---|---|
s365_app_id s365_app_secret | Server PolicyDS_MIP_INIT | If empty, PKCE; if filled, Confidential | Method Decision |
s365_pkce_appid | Server PolicyDS_MIP_INIT | PKCE Client ID (Priority) | recommended |
login.pkce-clientId | DS365.Core.json | PKCE Basic Client ID.s365_pkce_appidUsed when not set. Can be replaced by environment without redistribution. | s365_pkce_appidRequired when not in use |
warning
Warning:s365_pkce_appid(Server Policy) andlogin.pkce-clientIdIf the configuration file is empty, you cannot log in without built-in defaults. One of the two must be set.
Configuration File Example (DS365.Core.json):
{
"login": {
"pkce-clientId": "9586b6e7-7f17-4d18-871b-051705bd5eb6",
"title": "SOFTCAMP,Security365"
}
}
Operation Scenario
| situation | result |
|---|---|
| First Use (Online) | Browser Login → Token Issuance·Storage |
| Save token valid | Immediate use without communication (including offline) |
| Access Token Expiration (Online) | Automatic Renewal, Window Not Displayed |
| Access Token Expiration (Offline) | Cannot renew → Online required |
| Refresh Token Expiration (Online) | Browser Re-login |
| DS Mi-login / Re-authentication required in offline status | Network Error Notification, Window Not Displayed |
| Account Deactivation | Immediate failure, administrator action required |
Constraints
| # | Restriction | detail |
|---|---|---|
| C1 | Online required for initial use and token renewal | Browser login · Server communication required for automatic renewal |
| C2 | Available for offline use when holding a valid token | Offline operation before the storage token expires |
| C3 | Re-login when the refresh token expires | Automatic renewal not possible → Browser re-authentication |
| C4 | Re-login when changing tenant | Discard storage token in case of company mismatch |
| C5 | Admin Actions When Account is Inactive | Re-authentication window not displayed, account activation required |
| C6 | DS Login Prerequisites | The MIP conversion menu is only displayed when logged in to document security. |
| C7 | login.titleConfiguration Required (Operation) | If not set, the login window will not close and will be canceled after about 10 seconds. |
| C8 | shieldrm-svcServer registration required | Unregistered Grade Inquiry · MIP Blocking |
| C9 | PKCE client ID must be set in at least one place. | s365_pkce_appidorlogin.pkce-clientIdOne or more required, otherwise login not possible |