Skip to content

PLOSSYS Mobile Client

Introduction

With PLOSSYS Mobile Client, you start print jobs directly from your mobile device. The app uses PLOSSYS Output Engine and PLOSSYS Print Client for printing. PLOSSYS Mobile Client integrates into your existing corporate infrastructure.

Key Features

  • Mobile printing: The app allows you to send print jobs directly from your mobile device to company printers. You can use files on your smartphone or share output data from other apps via PLOSSYS Mobile Client.

  • Pickup printing: Print jobs are stored and only released at the printer once the user has authenticated themselves. Pickup printing increases the security of confidential documents and helps to reduce unnecessary printing.

  • Document verification: The app checks whether a printed, OptiHash-sealed document is authentic or has been tampered with. You start the check from Explore and scan the QR codes printed around the document with the camera. The check runs fully on-device. No network access is needed. This is an optional feature. An administrator enables it via MDM. Refer to Document Verification for details.

  • OTP-protected pickup: The app can require an OTP step before a pickup job moves to a printer. This adds a security layer for confidential print jobs. This is an optional feature. An administrator enables it via MDM.

Hint - MDM-managed features

Document verification and OTP-protected pickup are advanced capabilities. In production, both are off by default. An administrator enables them via MDM. Refer to Configuration via MDM.

System Architecture

┌─────────────────┐
│  Mobile Client  │
│   (Flutter App) │
└────────┬────────┘
         │ HTTPS (OpenID Connect)
         ▼
┌─────────────────┐
│     Operator    │
│   (SEAL Server) │
└────────┬────────┘
         │ IPP
         ▼
┌─────────────────┐
│  Output Engine  │
└────────┬────────┘
         │ Print Jobs
         ▼
┌─────────────────┐
│     Printers    │
└─────────────────┘

Hint - no direct Output Engine connection

PLOSSYS Mobile Client communicates only with SEAL Operator. There is no direct connection to PLOSSYS Output Engine.

Session Management

The app does not store user credentials. Session lifetime is controlled entirely via Keycloak.

  • Access Token Lifespan: Validity of a single access token. The app refreshes it automatically on expiry. Default in the SEAL realm: 30 minutes.
  • SSO Session Idle: Maximum inactivity period before Keycloak expires the session. Default in the SEAL realm: 1 hour.
  • SSO Session Max: Absolute maximum lifetime of the SSO session, regardless of activity. Default in the SEAL realm: 10 hours.

The access token is short-lived but the app keeps the user logged on by refreshing tokens automatically while the Keycloak session remains valid. Once the SSO session or refresh token expires, or if a refresh attempt fails, the app logs the user off and requires a new logon.

You can change all three values in the Keycloak realm settings. Other identity providers might use different values.

Ports

Ports are part of the Operator URL. No separate configuration is needed. Examples:

  • Standard HTTPS, port 443: https://operator.example.com/server-api/v1
  • Custom port 8443: https://operator.example.com:8443/server-api/v1

Hint - required network access

The app only requires access to the externally reachable Operator and Keycloak URLs. No direct access to Output Engine, printer, or internal service ports is needed.

Requirements

Hint - supported Operator versions

PLOSSYS Mobile Client can connect to any SEAL Operator instance as of version 1.6.0, as long as SEAL Operator is correctly configured with OpenID Connect and the user exists in the identity provider. Additionally, PLOSSYS Mobile Client has to be added to ALLOWED_OIDC_CLIENTS. For details, refer to Operator Server Configuration.

Keycloak Client Configuration

This section describes how to set up the required Keycloak client for the PLOSSYS Mobile Client.

  1. In Keycloak, navigate to Clients > Create and set:

    • Client ID: for example seal-plossys-mobile-client
    • Client Type: OpenID Connect

  2. Configure the access settings:

    • Access Type: public
    • Standard Flow: ON
    • Implicit Flow: OFF
    • Direct Access Grants: OFF

  3. In the Advanced settings, set Proof Key for Code Exchange Method to S256.

  4. Add the following redirect URI:

    de.sealsystems.plossysmobileclient.public://oauthredirect

  5. If the realm defaults do not provide the client scopes, configure them as follows:

    • Assigned Default Client Scopes: email, profile, roles, web-origins
    • Assigned Optional Client Scopes: address, offline_access, phone

  6. In the created client, navigate to Roles > Create and create the role seal-print-client-user.

  7. Assign this role to all users or groups that should be allowed to use the PLOSSYS Mobile Client.

Hint - missing role mapping

Without the seal-print-client-user role mapping, logon can succeed at Keycloak but SEAL Operator returns 403 Forbidden.

Operator Server Configuration

To allow PLOSSYS Mobile Client to access SEAL Operator, add the client to ALLOWED_OIDC_CLIENTS in the Operator configuration:

{
  "seal-plossys-mobile-client": {
    "roles": {
      "seal-print-client-user": {}
    }
  }
}

Caution - existing clients

If ALLOWED_OIDC_CLIENTS already contains other clients, add seal-plossys-mobile-client as an additional entry to the existing JSON object. Do not replace the existing value. Otherwise, the entries of the other clients are removed.

The client ID used here must match the clientId value configured in MDM or entered manually in the app.

Configuration via MDM

Example (iOS)

To configure the app via MDM, provide the following keys in your Managed App Configuration. Use the Apple property list format:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>sealClientUrl</key>
    <string>https://operator.example.com/server-api/v1</string>

    <key>allowManualConfigFallback</key>
    <false/>
  </dict>
</plist>
Key Type Required Default Description
sealClientUrl String Mandatory unless manual fallback is used (empty) Base URL of the Operator server. Must include /server-api/v1.
allowManualConfigFallback Boolean (true/false) Optional true If true, the user can enter the Operator URL manually in the app. Set to false to enforce the MDM-provided URL.
authUrl String Optional (empty) OIDC discovery/realm URL of the identity provider. Falls back to manual entry in the app if omitted.
clientId String Optional (empty) OIDC client ID configured in the identity provider. Falls back to manual entry in the app if omitted.
advancedCapabilities Boolean (true/false) Optional false Shows the Advanced Capabilities section in Settings and lets the user toggle the features below. If false, the section is hidden and the features are controlled entirely by MDM.
documentVerification Boolean (true/false) Optional false Enables guided document verification. With advancedCapabilities set to true, this becomes a user toggle, on by default. With advancedCapabilities set to false, this value is enforced.
otpAuth Boolean (true/false) Optional false Requires OTP authentication when moving print jobs. With advancedCapabilities set to true, this becomes a user toggle, on by default. With advancedCapabilities set to false, this value is enforced.

Hint - manual entry fallback

If authUrl and clientId are not provided via MDM, the user must enter them manually in the app. The allowManualConfigFallback key controls whether manual input is permitted at all.

Hint - sealClientUrl

If SEAL Operator is exposed on a custom port, include it in the URL, for example https://<operator-host>:8443/server-api/v1.

Base URL Configuration

  1. MDM: The app reads the URL from the sealClientUrl key. This is the preferred method.
  2. Manual fallback: Enabled via the allowManualConfigFallback key in MDM.

The behavior depends on the allowManualConfigFallback MDM key:

  • true: The user may override the MDM-provided URL with a manually entered one.
  • false: The MDM-provided URL is enforced. Manual input is not permitted. If the managed URL is invalid, the app shows an error screen and cannot proceed until a valid URL is pushed via MDM.

Manual Configuration

If no MDM configuration is present, or if allowManualConfigFallback is set to true, the user can configure the connection manually in the app.

The following values must be entered manually:

  • Auth URL: OIDC discovery/realm URL of the identity provider
  • Client ID: OIDC client ID
  • Server URL: Operator base URL

The app validates each value before proceeding. If a value is invalid, an error is shown and the logon is not opened.

Changes to Auth URL or Client ID in the app settings log the user out and require a fresh logon. A change to the Server URL alone does not trigger a logout, provided the new URL is reachable with the existing session.

Application

  1. When you start the app, log on with your user name and password. If the server URL is not pre-filled, enter it as well.

    Logging on

  2. The homepage shows jobs that are currently being printed and your most recently printed ones. For a complete list of all your printed jobs, tap View all at the bottom right.

    Homepage

  3. The Explore menu item provides an overview of the functions. To receive a pickup job, tap Pickup Jobs and scan the QR code on the printer to start printing. If an administrator enabled document verification via MDM, Document verification also appears here. Refer to Document Verification.

    The Explore menu item provides an overview of the functions.

  4. To start a print job directly, select Mobile Printing. You can upload one or more files here.

    Mobile Printing

  5. Language, system design, printer settings, and server connection are managed via the Settings menu item. You can choose English or German as language.

    Settings

  6. Under Custom Theme, you can choose between light or dark design for the app.

    Custom Theme

  7. Under Print Settings, you can set defaults, for example for color mode, duplex printing, and number of copies.

    Print Settings

Document Verification

Document verification lets you check whether a printed, OptiHash-sealed document is authentic, without a network connection.

  1. Open Explore and tap Document verification.

  2. Point the camera at the document and tap Scan QR. The app scans the QR codes printed around the document and collects codes from them.

  3. Once the app has collected enough codes, it verifies the signed payload on-device.

  4. The app checks the protected document regions with OCR.

  5. The app shows one of these results:

    • Authentic: the document codes are valid and the checked content matches.
    • Tampered: one or more checked areas do not match the document codes.
    • Inconclusive: the app could not determine a result. Scan again with the full page visible.

Caution - single issuer only

Document verification currently verifies documents from a single, fixed issuer only.

Authentication (OpenID Connect)

The app uses the OAuth 2.0 Authorization Code Flow with PKCE as a public client. The PKCE method is S256.

Parameter Value
Protocol HTTPS
Auth Method OAuth 2.0 Authorization Code Flow with PKCE (S256)
Client type Public (no client secret)
Discovery URL {authUrl}/.well-known/openid-configuration
Client ID Configured via MDM or manually, for example seal-plossys-mobile-client
Scopes openid, profile, email
Token storage flutter_secure_storage

The required runtime values are provided either via MDM or entered manually in the app:

  • sealClientUrl: Operator server base URL
  • authUrl: OIDC discovery/realm URL
  • clientId: OIDC client ID

Hint - authUrl format depends on Keycloak version

The format of authUrl depends on the Keycloak version in use:

  • Up to Keycloak 17, the path includes /auth: https://<server>/auth/realms/SEAL
  • As of Keycloak 21.0.1, the path no longer includes /auth: https://<server>/realms/SEAL

Communication & Error Handling

  • All traffic: HTTPS, Bearer token authentication
  • Token is refreshed automatically on expiry
HTTP Status Behavior
401 / 403 Automatic logout
500+ Error toast (rate-limited)
Network err Connection error message

Hint - self-signed certificates

PLOSSYS Mobile Client relies on the mobile operating system for HTTPS certificate validation. If the Operator server uses a publicly trusted CA certificate, PLOSSYS Mobile Client works without any additional configuration. One example is a certificate from Let’s Encrypt. If a self-signed or privately issued certificate is used, the corresponding root certificate must be installed on the devices so that the app can trust the Operator server. Typically, the root certificate is installed via MDM or manually.

Back to top