topic Re: WebEx SSO Setup in Collaboration Applications

WebEx SSO Setup

Velocity2089 — Sun, 17 Mar 2019 22:36:04 GMT

Hello. I'm currently trying to set up SSO for WebEx and used the documentation provided by Kinglsey Lewis. I do get to the point of receiving a login prompt for a user ID and password, but it doesn't seem to authenticate. I'm not sure what I'm missing with this and it's making me crazy!! Does anyone have any possible thoughts? Any help would be greatly appreciated!!

Re: WebEx SSO Setup

keglass — Thu, 03 Oct 2013 20:03:21 GMT

Raymond,

Sorry to hear you are having trouble with your WebEx SSO. I recommend you also post this to Webex Support at https://support.webex.com/MyAccountWeb/supporthome.do for more feedback and information. Technical experts are available 24/7 for assistance.

Thank you for participating in the community.

Kelli Glass

Moderator for the Cisco Collaboration Community

Re: WebEx SSO Setup

jameskeagie — Sat, 05 Oct 2013 22:38:29 GMT

What SSO provider are you using?

Re: WebEx SSO Setup

Velocity2089 — Sat, 05 Oct 2013 22:40:20 GMT

I'm currently using ADFS 2.0 for the setup.

Re: WebEx SSO Setup

Velocity2089 — Sun, 06 Oct 2013 16:37:09 GMT

Now I get "User authentication failed,

Reason: Invalid Response message (29)"

Thoughts???

Re: WebEx SSO Setup

jameskeagie — Mon, 07 Oct 2013 16:40:25 GMT

Raymond,

We also use ADFS 2.0 - perhaps you would want to PM me screenshots of your WebEx SSO config and ADFS config and I can take a look? Is your WebEx org setup for auto-account creation via SSO, and also is this just WebEx Meetings or WebEx Connect as well?

Re: WebEx SSO Setup

Velocity2089 — Mon, 07 Oct 2013 16:52:05 GMT

Hi James!

Thanks for reaching out. Here's some screenshots to hopefully help a bit. If you need others please let me know. To answer your questions, I haven't gone as far as doing the auto-account creation yet or for WebEx Connect/Jabber. Just focusing on the Meeting Center right now.

Ray

Re: WebEx SSO Setup

Velocity2089 — Mon, 07 Oct 2013 16:52:47 GMT

Also to add, you'll notice I'm trying to do SSO for Yammer as well. Having a similar issue with authentication.

Re: WebEx SSO Setup

Velocity2089 — Tue, 08 Oct 2013 19:48:22 GMT

Hi James,

Did you have a chance to take a look at these images? Please let me know.

Thanks.

Re: WebEx SSO Setup

jameskeagie — Wed, 09 Oct 2013 21:14:55 GMT

Before trying anything else - make sure you can actually authenticate to the ADFS service. Visit the following URL (adjusted for your domain) and enter your AD creds. If this URL isn't there, than your customer SSO service login URL isn't working or is in a different location than you have configured in the WebEx SSO config. Also, make sure this URL is externally accessible so WebEx can reach it.

https://fullyqualified.servername/adfs/ls/IdpInitiatedSignon.aspx

You should get a page like this:

If you choose "Sign Into this Site" you will be authenticated to ADFS (may automatically happen depending on your browser settings and authentication modes enabled in ADFS, such as NTLM vs Digest for Firefox support, and your security zones in IE etc.)

Assuming that you are presented with the option here, this should work. This is also a good place to use for debugging, as it verifies whether ADFS is authenticating you, and where claims are failing. If you install fiddler on ADFS (or wireshark) you can track as you send SAML requests initiated by this page while logged in. Clicking "go" to login to your WebEx environment should get you right there once its working. Since you mentioned other services also aren't working, I'm wondering if you have a more core issue in ADFS going on.

But if you can authenticate to ADFS, its just a discrepancy in claims rules, so try the following.

On the WebEx Side:

The default webex target page URL can be blank. Your current webex.sitename.com format probably doesn't work, as it should be sitename.webex.com

I notice your WebEx SAML Issuer ID is still the default - we use Connect so have changed it to http://sitename.webex.com - make sure this issuer ID matches your settings in ADFS.

I know Kingsley recommends not setting a userid format, but we couldn't get around it.

On the ADFS Side:

1.) Your LDAP attribute mapping to WebEx Name ID is sAMAccountName. You have user account creation off, so you have to have an account in WebEx matching the username of your sAMAccount name. Do you already have that?

I see no other claims being passed - that may be fine for just basic auth, but if you want account creation & update, you'll need to continue with Kingsley's guide.

If all of that looks good and you're still getting issues, I'd start to look at the certificate exchange, but since you're having issues with other services through ADFS as well, I'd then guess its somewhere in ADFS's claims provider trusts, or the Issuance Authorization rules on a specific relying party trust. If the latter, you should be able to login to ADFS's web page, but not get into any services (although that could also be claims or cert exchange issues).

The ADFS debugging logs in Windows are actually also pretty powerful as well, so if you're getting authentication failures right to ADFS, I'd start there.

Hopefully that gets you going in the right direction!

Re: WebEx SSO Setup

Velocity2089 — Thu, 10 Oct 2013 00:49:56 GMT

Hi James,

Thanks for this great post! For starters though let me explain what's happening right off the bat. I do get to that web page and choose "Sign in to this site" and get prompted for credentials but they don't take. Just keep prompting over and over again, which is the same result on WebEx. Clearly it seems it's not authenticating internally to ADFS itself. Would you have any ideas why this would occur? It sounds like I should be able to authenticate to myself (ADFS) with no problem correct?

Thanks!

Re: WebEx SSO Setup

Velocity2089 — Fri, 11 Oct 2013 13:50:48 GMT

Hi Everyone,

I've made some solid progress here and have gotten SSO working, but it seems to only work for FireFox and does NOT work in IE or Chrome. Any ideas on that?

Thanks!

Re: WebEx SSO Setup

jameskeagie — Fri, 11 Oct 2013 13:54:56 GMT

Raymond,

You'll want to look at the authentication types in ADFS. This is all outside of the scope of UC, and would definitely be on the AD side, so you'll find more help on Microsoft's websites.

http://social.technet.microsoft.com/wiki/contents/articles/1600.ad-fs-2-0-how-to-change-the-local-authentication-type.aspx

Are these logon attempts coming from the proxy or internal? The article above clarifies much of that, and you'll also want to verify your browser security settings. Regardless, you should at least be prompted for credentials in any browser if IWA/NTLM fails if the environment is build to Microsoft's best practices, so you may want to go back through their implementation guides.

Glad to hear you were able to narrow it down to ADFS and make some solid progress - I know this integration can be daunting for us UC folks!

Re: WebEx SSO Setup

Velocity2089 — Fri, 11 Oct 2013 14:30:36 GMT

Hi James,

These prompts to come internally on the browsers. I do get prompted in both Chrome and IE for credentials (like I do in FireFox) but they don't authenticate through. It seems to get stuck in a loop and keeps prompting over and over again.

Thanks,

Ray

Re: WebEx SSO Setup

jameskeagie — Fri, 11 Oct 2013 14:34:37 GMT

I would definitely look at your IIS configs as listed in that document then for your ADFS environment. If its internal, you can do a Fiddler trace from your client machine, (will probably need to install the HTTPS proxy on your client to decode SSL traffic) to see what HTTP response headers you are getting back during that loop. That, combined with the Failed Request Tracing in ISS (good tutorial here: http://www.iis.net/learn/extensions/url-rewrite-module/using-failed-request-tracing-to-trace-rewrite-rules) should narrow down exactly where in your ADFS environment your authentication attempts are failing.

Casey Bleeker | Unified Collaboration Administrator | Colorado Community College System

T: 720.858.2824 | M: 303.330.8467 | F: 720.858.3126

Re: WebEx SSO Setup

Velocity2089 — Wed, 06 Nov 2013 14:59:34 GMT

Hi Everyone!

I did make some solid progress with SSO and was able to get it working. Took some unique configurations here and there but I was able to get it going with all browsers. Now I'm working to have a proper certificate in place so that users are prompted with warning pages when trying to login. In this case I got a Digicert certificate and have uploaded that to my server.

On the WebEx end though, does that Certificate need to get uploaded to the WebEx site??

Thanks!

Re: WebEx SSO Setup

jameskeagie — Wed, 06 Nov 2013 15:02:42 GMT

Raymond,

That cert is just going to go on your SSO provider. You do have to do a certificate exchange with webex so they trust your SSO provider. I believe its under the site certificate manager in Webex admin.

Casey Bleeker | Unified Collaboration Administrator | Colorado Community College System

T: 720.858.2824 | M: 303.330.8467 | F: 720.858.3126

Re: WebEx SSO Setup

Velocity2089 — Wed, 06 Nov 2013 16:44:34 GMT

Hi James,

Would the Digicert certificate be added here though? So in instructions I've seen, the self-signed certificate from the server gets added here. But I would assume if you decided to you a cert from a 3rd party like Digicert, that would get replaced?

Thanks,

Ray

Re: WebEx SSO Setup

jameskeagie — Wed, 06 Nov 2013 17:03:25 GMT

Correct – whatever cert is installed on the SSO server (self-signed, signed by your domain CA, or 3rd party) will need to be exchanged with the WebEx environment in the cert manager. I would definitely recommend at a minimum a cert signed by your domain CA root authority, or a 3rd party, so that your clients won't get prompted to accept the cert.

Re: WebEx SSO Setup

Velocity2089 — Wed, 06 Nov 2013 17:08:19 GMT

Ok great, that makes sense. Now about about in ADFS 2.0 in the certificate store. Do changes need to be made there? I noticed even when I added the cert to WebEx, I'm still getting a certificate prompt.

Also just to add, my servername is "XYZ.Domain.Local" and my certificate is actually signed to "SSO.Domain" and we've set up a DNS record to point from that SSO address to the servers public IP address.

So would changes need to be made for this? I'm assuming somewhere with the Issuer for SAML? Which is typically.

http://servername/adfs/services/trust