Voicemail login issue on Jabber with SSO

[Hunor Szombatfalvi]

Hello All,

I seem to have a strange issue, we have an environment that is SSO enabled, both CUCM/IMP and CUC. You can log into Jabber without any issues and every service connects except CUC, which is still asking me for a username and password in jabber settings.

When I check jabber logs I can see that it actually connects to CUC via SSO successfully in the background, but within the client it is still asking me for the account. As far as I know (checked on a working system), the account settings for CUC should not even be present in a jabber deployment that uses SSO.

The users for CUC are LDAP synchronized, if that makes any difference. I can also log into the CUC web inbox from a browser on the machine running the jabber client and I can't really see anything that look like blocked connections in wireshark.

Regards,

Hunor

[Roger Kallberg]

Have you defined an AuthZ server in CUC? For more information on this please see this presentation from Cisco Live.

[Hunor Szombatfalvi]

AuthZ server is defined and it's pointing to the CUCM Publisher

[b.winter]

Is SSO also enabled in CUC?

What is your setting in the Service-profile for "Credential source for voicemail service"?

Did you enable oAuth in CUCM and / or CUC?

[Hunor Szombatfalvi]

SSO is enabled both on CUCM and CUC

I tried everything for credential source settings, however, correct me if I'm wrong but with SSO enabled that setting should not actually make any difference?

oAuth is not enabled for either CUCM or CUC (might be something to try)

[brettlee77]

Do you have any solution ? 
I have same issue

[Ibrahim AlQumairi]

User Service Profile assigned to the User who is using Jabber - Credentials sources for VM as below screenshot:

[brettlee77]

I have same setting already and I still have Issue . Any thoughts ? I can’t find much in PRT

[b.winter]

If it is not working, there must be something in the Jabber PRT.

Maybe your SSO in CUC is not working? Assign a user the "administrator role" and try to login into the CUC-administration GUI via browser from this user's PC.
If the login is working, SSO in CUC should be fine, if not, then SSO is not working.

If you are using CUC 12.5 or lower, you could also browse to "https://<CUC>/inbox" and check if you are logged in automatically via SSO.

Or disable SSO in CUC again and try to login with normal user / LDAP password (if you have LDAP authentication enabled).

[brettlee77]

Basically only single user with MAC is facing issue , no other users are facing this issue.

That user can access the mailbox and CUC server from web browser. When user is entering password manually jabber connects to the voicemail server but it gives pop up that credentials are invalid and then changes have been detected please sign out. I am attaching the PRT , You help will be appreciated.

[Roger Kallberg]

As it’s affecting only a single user it’s not very likely that there is any issue in the central part of the system landscape. What I would suggest is that you have the user login to a known working computer and check if he or she has the same issue. If not you’ve pretty much narrowed the problem down to be computer related and then you can focus on that part of troubleshooting.

[brettlee77]

Hi Roger,

Totally makes sense , we have only 2 users in that particular location and one is using windows and another is using MAC. Both were having issues but suddenly Windows user is getting through but not mac user. This is very strange and configuration from our side is all ok.

[brettlee77]

User tried on different issue but same user , checked from AD side as well but there is no issue with this user . I am not sure at this point what to do 

[Roger Kallberg]

Would you please mind to clarify what you mean by “User tried on different issue but same user”? It is not very clearly worded.

[brettlee77]

Oh I’m really sorry for a typo I meant - User tried on different system but same issue faced , but we found the solution , not yet tested though but we added MRA profile in UC service profile and test user’s issue resolved , however we are using same uc profile for another they don’t have this issue . But I will keep you posted on this .