Jabber cannot communicate with server after authentication.

[Tareq Ali]

Jabber cannot communicate with the server after authentication.

No Errors on logs on the C

2021-03-11T16:32:31.508+00:00 edgeconfigprovisioning: Level="INFO" Detail="Authenticated user successfully" Username="xyz" ClientId="81.130.172.17" TrackingID="4849d441-cf54-4225-b4de-b889f0bf3487" UTCTime="2021-03-11 16:32:31,507"

Expressway-E Logs

2021-03-11T16:32:28.787+00:00 traffic_server[27485]: Event="get_edge_sso" Detail="Access denied" Reason="Only legacy auth supported" Domain="xyz.uk" Src-ip="81.130.172.17" Src-port="61970" UTCTime="2021-03-11 16:32:28,787"
2021-03-11T16:32:28.771+00:00 traffic_server[27485]: Event="get_edge_sso" Detail="Access denied" Reason="Only legacy auth supported" Domain="xyz.uk" Src-ip="81.130.172.17" Src-port="61970" UTCTime="2021-03-11 16:32:28,770"

No Issues logging in with Jaber locally.

[Tareq Ali]

Thank you Roger & Nithin for your help.

Just to let you know where I am the Jabber client can log in from a PC / iPhone & Andriod but unfortunately, the jabber softphone is unable to register,( no call services available ) but all other jabber features like voicemail and corporate directory, hunt group, and single number reach features are working on the jabber client.  So just the softphone not registering thus unable to make calls.

[Roger Kallberg]

The call service would use UDS lookup. Are all of these SRV recorde setup correctly and do you have ILS setup between you CM clusters. Also the users need to have Home Cluster set on the end user page and make sure it is only enabled in one CM per user.

[Tareq Ali · Accepted solution]

Our Jabber client is now working we had to disable SIP ALG on the checkpoint firewall for port 5061 for the jabber clients to register.

Thank you for your help and advice.

[gfolens]

This bug could also be one of the causes: CSCvz20720

Symptom: Expressway connections to CUCM over port 6972 failing with "tlsv1 alert unknown ca" and "502 connect failed" errors. 

Conditions: As of x14.0.2 (due to some improvements in traffic server service), Expressway will send its client certificate whenever a server (CUCM) requests it, for services running on ports other than 8443 (e.g., 6971,6972) even if CUCM is in non-secure mode. 

Workaround: This improvement, enabled by default in Expressway code, requires Expressway-C certificate signing CA to be added in CUCM tomcat-trust and CallManager-trust list. You must also restart tftp services on each CUCM and issue CUCM command utils service restart Cisco HAProxy