Differences

This shows you the differences between two versions of the page.

--- vendors:cisco:sso:azureguide [2022/11/02 09:13] – [Summary] gerardorourke
+++ vendors:cisco:sso:azureguide [2022/12/13 09:49] (current) – [Summary] gerardorourke
@@ Line 25: / Line 25: @@
 When NOT using SSO - CUCM doesn't support using a suffix which is different that the main suffix in the AD / LDAP.
-As it attempts to find the user in the LDAP with the suffix of the user - which might NOT be how the LDAP is setup.
+i.e. CUCM attempts to find the user in the LDAP with the suffix of the user entered - which might NOT be how the LDAP is setup and so the user might not be found - even if this IS their uPN. This is a bug on CUCM side - which is NOT been fixed. i.e. Cisco workaround is "use mail attribute".
-This is a bug on CUCM side - which is NOT been fixed.
 When using SSO this issue doesn't occur as it doesn't attempt to verify and authenticate the user against the AD - but with SSO.
-However with SSO and uPN Jabber has a bug.
+However with SSO and using uPN - Jabber has a bug.
-Jabber attempts to find the user in CUCM by matching the username entered against CUCM users - but it uses the mail attribute and not the userID in CUCM to find the user.
+Jabber attempts to find the user in CUCM before attempting the SSO.
+It finds the user in CUCM by searching for that users mail attribute and not against the userID in CUCM.
+So if the user doesn't have a mail attribute or entered their uPN which is different that the mail attribute no SSO will be attempted as the user is not found.
-So in effect the user has to enter their mail attribute as their username.
+So in effect the user has to enter their mail attribute as their username in Jabber.
-Jabber finds the user and THEN SSO will be attempted with the uPN - which is VERU confusing for the user if the uPN doesn't match the mail attribute.
+Jabber finds the user and THEN SSO will be attempted with the uPN - which is VERY confusing for the user if the uPN doesn't match the mail attribute.
-And if it always does match teh mail attribute - why use uPN - just use the mail attribute instead.
-Awaiting to test the behaviour of Webex One and CUCM and if it replicates this Jabber bug.
+And if it always match for all users why use uPN - just use the mail attribute instead.
+Awaiting to test the behaviour of Webex One and CUCM and if it replicates this Jabber bug....
+Update!
+Webex one works with uPN and SSO.
 ===== Export UC Metadata Files =====