Does Hybrid Jabber SSO REQUIRE CUCM and CUC also be SSO?

[Stephanie Knoop]

If I want to SSO enable Jabber (Messenger/Cloud), is it a requirement that I simultaneously enable SSO on CUCM and CUC for the phone and voicemail services to connect in Jabber, or can the end user still manually set the account name for phone and voicemail services?  Elementary question, but I can't find the answer.  Thank you.

[Mark Swanson]

Are you trying to integrate voicemail and associate devices to users, for click-to-x purposes within Jabber? 

[Stephanie Knoop]

Jabber will be deployed (is deployed already) as a full UC client. We do integrate with CUCM and CUC today. I've been asked to SSO the jabber login (Messenger cloud), but am concerned about the user experience if I don't simultaneously SSO CUCM and CUC. To have to SSO all 3 at once seems like asking for trouble, so wanted to know what is possible here from a phased approach. So, to answer your question...click to call is not the goal here; not breaking the UC integration is the goal (allowing users to place and receive calls/voicemail, period is). Thanks for your time!

[Mark Swanson]

No, you shouldn't have to configure SSO for CUCM and CUC as well. Are you using UDS, if so, what does your Service Profile configs look like? And, what does your jabber-config.xml look like?

Within your Service Profile which is located here; CUCM Admin > User Management > User Settings > Service Profile. You specify the Primary and Secondary servers for the IM and Presence Profile. This could be 'Unified CM (IM and Presence)' or 'WebEx (IM and Presence). If you declared 'WebEx (IM and Presence)' as the UC Service Type, then authentication is handled by WebEx.

If you haven't already done so, you can alter the default parameters for Cisco Jabber, to include;

SSO_Enabled - default value is true

Start_Client_On_Start_OS - default value is false

Before the user logins, they should select the 'Automatic Sign-in' checkbox. This causes Jabber to cache your credentials under the CSF > Credentials folder. This trust file is referenced during the login process.

The main benefits of using SSO via IdP is...

- So users with Common Access Cards (CAC) or tokens could bypass the login process by establishing a trust relationship with the IdP because in this case, users don't have passwords.

- So users can SSO into CUCM Admin, IM&P Admin, Unity Admin, etc. webpages or CUCM Self-Care Portal and yes, WebEx as well.

However, most users don't login or need access to these services... the only exception might be CUCM Self-Care Portal.

Check out these websites;

https://supportforums.cisco.com/t5/jabber-clients/webex-login-for-jabber/td-p/2627735

https://www.cisco.com/c/en/us/support/unified-communications/jabber-windows/products-installation-guides-list.html

[peng_wang1]

I have the same questions too. Have you already implemented SSO? I'm wondering what's the user experience vs. non-SSO and what's recommended steps if we have to go for SSO. Thanks!