topic Re: Jabber login need to use mail-ID instead of user-ID in Collaboration Applications

Jabber login need to use mail-ID instead of user-ID

Risat — Thu, 14 Jan 2021 13:30:31 GMT

Hi,

In our current MRA setup we have internal and external domains, and user email address is yet in another domain, so for example

CUCM/IMP/Exp-C - intdomain.com

Exp-E -extdomain.com

user-ID - johnsmith

email-ID - jsmith@domain3.com

Now user able to login with the user-ID (johnsmith@extdomain.com) successfully without any issues.

What we need is to change the jabber login ID to email-ID (jsmith@domain.com)

Can you kindly advice how can we establish this ?

Re: Jabber login need to use mail-ID instead of user-ID

Nithin Eluvathingal — Tue, 12 Jan 2021 12:19:29 GMT

Have a look on below link.

https://www.cisco.com/c/en/us/support/docs/unified-communications/expressway-series/117811-configure-vcs-00.html

Re: Jabber login need to use mail-ID instead of user-ID

Risat — Tue, 12 Jan 2021 15:12:05 GMT

Hi,

Thanks for your reply, i saw this doc earlier, but i have something different here as I mentioned.

Apart from the domain difference, the email iD is also different from the user-ID, for example user-ID will be johnsmith@extdomain.com whereas email-ID will be jsmith@domain3.com

Re: Jabber login need to use mail-ID instead of user-ID

Adam Pawlowski — Tue, 12 Jan 2021 15:43:44 GMT

I don't believe that works or is supported.

The lookup is going to be based on domain, then back to UDS search in the CM, then off to CUPS to authenticate I believe. So, johnsmith@domain3.com would discover services @domain3.com, then try ID johnsmith which should resolve on UDS. Beyond that I am not sure at that point if things will break further if you are synchronizing URIs with domain3.com and URIs are in use for CUPS.

I just tested a <userid>@<some other domain which points to my expressway cluster> and that worked just fine after authentication, but, userid maps, and really has no bearing on email.

While not saying if it's possible or not, I would consider trying to align your userIDs with the user portion of the email address the customer users, which works well in this product's design.

Re: Jabber login need to use mail-ID instead of user-ID

Risat — Thu, 14 Jan 2021 14:12:14 GMT

Hi,

I changed the LDAP attribute for user ID to mail, in the CUCM LDAP system configuration, now i can see the user-id has changed to the email-ID (userid changed from johnsmith to jsmith@domain3.com), and now i can login to the CUCM with the new user-ID (jsmith@domain3.com).

I created SRV records with the new domain internally and externally

(Internal -> nslookup -q=srv _cisco-uds._tcp.collab3.com

External -> nslookup -q=srv _collab-edge._tls.collab3.com)

Now am able to login jabber internally, but externally it is giving error 'Cannot communicate with the server'. In the PRT i can see the below:

CAS lookup request unsuccessful with domain: collab3.com

I have attached the logs that i took while i tested in my lab (in the logs the actual domain is cciecollab.cisco.com and email id domain is domain3.com)

Re: Jabber login need to use mail-ID instead of user-ID

Adam Pawlowski — Thu, 14 Jan 2021 14:37:54 GMT

You will want to look at the Expressway logs to see why it is rejecting you:

2021-01-14 17:19:56,141 DEBUG [0x000019dc] [netutils\src\http\CurlHttpUtils.cpp(217)] [csf.httpclient] [csf::http::CurlHttpUtils::curlTraceCallback] - Request #76 post connect phase: 'Connected to cfgexpehq.cciecollab.cisco.com (142.100.64.21) port 8443 (#3)'

2021-01-14 17:19:56,141 DEBUG [0x000019dc] [netutils\src\http\CurlHttpUtils.cpp(811)] [csf.httpclient] [csf::http::CurlHttpUtils::curlHeaderCallback] - Request #76 got status line: HTTP/1.1 403 Forbidden
2021-01-14 17:19:56,141 DEBUG [0x000019dc] [netutils\src\http\CurlHttpUtils.cpp(791)] [csf.httpclient] [csf::http::CurlHttpUtils::curlHeaderCallback] - Request #76 got CR-LF pair. Accumulated headers:

After it gives up connecting there it tries Webex Messenger, but, it's upset about the certificate at least for that too. If you're supposed to be connecting to the Expressway then it's not happy.

Re: Jabber login need to use mail-ID instead of user-ID

Nithin Eluvathingal — Fri, 15 Jan 2021 06:17:52 GMT

Did you added New Domain on expressway domains Tab.

Re: Jabber login need to use mail-ID instead of user-ID

Risat — Fri, 15 Jan 2021 06:55:28 GMT

No, I did not add it, i shall add and try. But when I checked the exp-e event logs i was not getting any traces of the log attempt, anyhow I shall try this and update you.

Re: Jabber login need to use mail-ID instead of user-ID

Risat — Thu, 21 Jan 2021 08:46:28 GMT

Thank you Nithin & Adam, Its working now, +5 for both of you :-).

The PC IP from where I was trying was in the blocked list, i removed it and then it started working. Below are the steps I followed, if it can help somebody else.

> Deleted the LDAP directory (without deleting LDAP directory the system will not allow to change the LDAP system config)
> Unchecked the LDAP authentication in CUCM
> Changed the LDAP system config to use 'mail' as LDAP attribute for User ID. I could see all the device associations remained as it is with the end user after the change, so there was no need to associate the jabber CSF profiles back to the end user

> Enabled back LDAP authentication in CUCM
> Added the new domain 'Collab3.com' to EXP-C
> Added the new domain 'Collab3.com' to IMP (IMP Admin > Presence > Domains)
> Created new SRV records for internal (Cisco-UDS) and external (Collab-edge) in internal and external DNS servers respectively
> Reset jabber and logged in internally and externally successfully