topic Re: Limit Jabber to specific endpoints in Collaboration Applications

Limit Jabber to specific endpoints

rm760 — Mon, 18 Mar 2019 01:38:11 GMT

Hello

I have been asked if it is possible to limit Jabber registrations to devices provided by the employer. If such is possible, I would appreciate any direction given.

Re: Limit Jabber to specific endpoints

skilambi — Thu, 19 Jan 2017 21:25:05 GMT

Ron

Today there isn't a perfect solution for this, user based policy enforcement and that too broken down by modality of communication like IM vs voice/video is on the roadmap. You can however use cert based auth with x8.9 and if you don't have the cert you won't login

Planning Guide for Cisco Jabber 11.7 - User Management [Cisco Jabber for Windows] - Cisco

Re: Limit Jabber to specific endpoints

rm760 — Thu, 19 Jan 2017 21:36:16 GMT

Srinivasan

I did read this, but interpreted it to mean that the user would no longer require credentials. Is this correct?

Re: Limit Jabber to specific endpoints

rm760 — Thu, 19 Jan 2017 21:43:28 GMT

Also allow me to add this is an on premise non cloud install

Re: Limit Jabber to specific endpoints

skilambi — Thu, 19 Jan 2017 21:51:21 GMT

Yes uses expressway and your MDM solutions to push cert and of course UCM

Thanks

Srini

Re: Limit Jabber to specific endpoints

skilambi — Fri, 20 Jan 2017 03:07:06 GMT

The cert would identify the user so yes it's basically SSO with certs

Thanks

Srini

Re: Limit Jabber to specific endpoints

rm760 — Sat, 18 Feb 2017 21:47:53 GMT

Srinivasan

I have enabled SSO on VCS-E, VCS-C, and call manager. VCS is set for exclusive MRA mode. SSO IdP is ADFS 2.0. USers are logging in via SSO. They can still use personal devices without certs on them to login just by knowing their AD credentials. Do I need to expand the relay or CoT to include the CA cert provider? If so please do detail how to go about doing so.

Re: Limit Jabber to specific endpoints

skilambi — Sat, 18 Feb 2017 23:48:52 GMT

Ron

Not sure since I don’t have a client who has deployed it yet. Maybe a case for TAC to check if this is working as designed. You would think without the certificate, the client won’t be allowed to login, if they found your password but I am not sure. I know more security policies through expressway are being planned like controlling user group access by type of communication but that shouldn’t stop this from working. Let me know what was the end result though?

Srini Kilambi

Re: Limit Jabber to specific endpoints

rm760 — Sun, 19 Feb 2017 18:19:23 GMT

Srini

I am thinking now along the lines of the IdP processing. Currently we are only doing form validation for credentials via Microsoft ADFS 2.0. I believe going to ADFS 4.0 and incorporating certificate validation is going to be the next step.