Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
vendors:cisco:sso:azureguide [2022/11/02 09:07] – [Troubleshooting] gerardorourkevendors:cisco:sso:azureguide [2022/12/13 09:49] (current) – [Summary] gerardorourke
Line 19: Line 19:
   -[[#configure_azure_custom_application|Import UC metadata files into Azure and configure Azure to provide identity services. Export a Federation Metadata File from Azure]]   -[[#configure_azure_custom_application|Import UC metadata files into Azure and configure Azure to provide identity services. Export a Federation Metadata File from Azure]]
   -[[#enable_saml_sso_for_collaboration_applications|Import the Azure metadata file into your Cisco UC applications and complete the SSO configuration]]   -[[#enable_saml_sso_for_collaboration_applications|Import the Azure metadata file into your Cisco UC applications and complete the SSO configuration]]
 +
 +<alert type="warning" icon="Using uPN with CUCM SSO">Note on using UPN with CUCM SSO</alert>
 +
 +There are various bugs and issues with using uPN with CUCM SSO and even without SSO.
 +
 +When NOT using SSO - CUCM doesn't support using a suffix which is different that the main suffix in the AD / LDAP.
 +i.e. CUCM attempts to find the user in the LDAP with the suffix of the user entered - which might NOT be how the LDAP is setup and so the user might not be found - even if this IS their uPN. This is a bug on CUCM side - which is NOT been fixed. i.e. Cisco workaround is "use mail attribute".
 +
 +When using SSO this issue doesn't occur as it doesn't attempt to verify and authenticate the user against the AD - but with SSO.
 +However with SSO and using uPN - Jabber has a bug.
 +
 +Jabber attempts to find the user in CUCM before attempting the SSO.
 +It finds the user in CUCM by searching for that users mail attribute and not against the userID in CUCM.
 +So if the user doesn't have a mail attribute or entered their uPN which is different that the mail attribute no SSO will be attempted as the user is not found.
 +
 +So in effect the user has to enter their mail attribute as their username in Jabber.
 +Jabber finds the user and THEN SSO will be attempted with the uPN - which is VERY confusing for the user if the uPN doesn't match the mail attribute.
 +
 +And if it always match for all users why use uPN - just use the mail attribute instead.
 +
 +Awaiting to test the behaviour of Webex One and CUCM and if it replicates this Jabber bug....
 +Update!
 +Webex one works with uPN and SSO.
  
 ===== Export UC Metadata Files ===== ===== Export UC Metadata Files =====
Line 212: Line 235:
 <code>file get activelog tomcat/logs/* recurs</code> <code>file get activelog tomcat/logs/* recurs</code>
  
-<alert type="warning" icon="Using uPN with CUCM SSO"></alert>+
  
  • vendors/cisco/sso/azureguide.1667380052.txt.gz
  • Last modified: 2022/11/02 09:07
  • by gerardorourke