Hi James!
Thanks for reaching out. Here's some screenshots to hopefully help a bit. If you need others please let me know. To answer your questions, I haven't gone as far as doing the auto-account creation yet or for WebEx Connect/Jabber. Just focusing on the Meeting Center right now.
Ray
Hi. If you enable SSO for WebEx Meeting Center, how does that affect the Meetings integration within Jabber? Can you still enter the credentials in that tab, per normal, or does SSO on Meeting Center REQUIRE that the IM cloud (Messenger) also be configured for SSO?
Did you have any significant issues with your implementation? Thank you.
Also to add, you'll notice I'm trying to do SSO for Yammer as well. Having a similar issue with authentication.
Before trying anything else - make sure you can actually authenticate to the ADFS service. Visit the following URL (adjusted for your domain) and enter your AD creds. If this URL isn't there, than your customer SSO service login URL isn't working or is in a different location than you have configured in the WebEx SSO config. Also, make sure this URL is externally accessible so WebEx can reach it.
https://fullyqualified.servername/adfs/ls/IdpInitiatedSignon.aspx
You should get a page like this:
If you choose "Sign Into this Site" you will be authenticated to ADFS (may automatically happen depending on your browser settings and authentication modes enabled in ADFS, such as NTLM vs Digest for Firefox support, and your security zones in IE etc.)
Assuming that you are presented with the option here, this should work. This is also a good place to use for debugging, as it verifies whether ADFS is authenticating you, and where claims are failing. If you install fiddler on ADFS (or wireshark) you can track as you send SAML requests initiated by this page while logged in. Clicking "go" to login to your WebEx environment should get you right there once its working. Since you mentioned other services also aren't working, I'm wondering if you have a more core issue in ADFS going on.
But if you can authenticate to ADFS, its just a discrepancy in claims rules, so try the following.
On the WebEx Side:
The default webex target page URL can be blank. Your current webex.sitename.com format probably doesn't work, as it should be sitename.webex.com
I notice your WebEx SAML Issuer ID is still the default - we use Connect so have changed it to http://sitename.webex.com - make sure this issuer ID matches your settings in ADFS.
I know Kingsley recommends not setting a userid format, but we couldn't get around it.
On the ADFS Side:
1.) Your LDAP attribute mapping to WebEx Name ID is sAMAccountName. You have user account creation off, so you have to have an account in WebEx matching the username of your sAMAccount name. Do you already have that?
I see no other claims being passed - that may be fine for just basic auth, but if you want account creation & update, you'll need to continue with Kingsley's guide.
If all of that looks good and you're still getting issues, I'd start to look at the certificate exchange, but since you're having issues with other services through ADFS as well, I'd then guess its somewhere in ADFS's claims provider trusts, or the Issuance Authorization rules on a specific relying party trust. If the latter, you should be able to login to ADFS's web page, but not get into any services (although that could also be claims or cert exchange issues).
The ADFS debugging logs in Windows are actually also pretty powerful as well, so if you're getting authentication failures right to ADFS, I'd start there.
Hopefully that gets you going in the right direction!
