I would like to take a moment here to reset some things. As this is not a formal TAC case I have skipped a couple of steps that would normally be in my first e-mail to you as a customer and for that I apologize. Below, I have written out what I believe your current solution you wish to implement as well as a description of your current setup. Finally I have ended this section with a list of the problem statements I see so far. If we aren't on the same page, please forgive me and make corrections where necessary.
Current description of your environment and question: You have CUCM cluster which is LDAP integrated to a Microsoft Active Directory (AD) for both User sync and for User Authentication. As demonstrated by the users being able to login to the CCMUser page, you are successfully integrated and there are no known issues here. You have a UCCX system (have not yet established whether simplex or HA) which is integrated to this CUCM cluster. Resources are properly configured and can login using CAD with their AD username and password. You would like to deploy IPPA to your users to eliminate the need for CAD in certain or all cases (the scope really makes no difference, just that you are wanting to deploy IPPA.) With the IPPA deployment, you would like to use the "One Button Login" or SSO configuration by creating the appropriate service(s) on the CUCM server. Finally, you require the ability of your users to update thier own IPPA SSO passwords to both eliminate the administrative overhead and maintain security of the passwords. From this you have the following issues:
Problem 1.) Users cannot login to IPPA using the SSO defined service at all.
Problem 2.) Users may not be able to login to the CCMUser page at all.
Problem 3.) Users cannot update their own passwords through CCMUser. (I believe this would be resolved if Problem 2 is resolved).
Based on the above, I have come up with several tests I would like you to try and reply with the results.
Test1.) Please try putting the exact URL for the IPPA SSO service defined in your CUCM into the URL of your browser. You should get something similar to the following:
Test 2.) Please create two phone services with the following URL:
Service 1 -- IPPA N1: http://
Service 2 -- IPPA N2: http://
These are the non-SSO version of IPPA but should prove that your phone can login to IPPA. In addition, you will note that I have changed the hostname to
Test 3.) Earlier, you have stated in your URL that you used "contactcenter". From this, I'm not sure if you used the name of the UCCX server or the IP. If you used the name, please change the service to be the IP of the server(s). The reason for this is that very few people configure DNS resolvers in their VoIP Subnet (hey why would a phone ever use those...) and then those who do configure the DNS resolvers either forget to add all the necessary static entries (UCCX servers are DDNS compatible last I checked) so that the phones cannot ever resolve the name provided.
Test 4.) Another thought that came to mind is to check your telecaster user setup. The details for this are in the CAD guides. Ensure that your CUCM has a telecaster user create (this will likely have to be added to AD for it to sync). Next, if your AD does not allow the default password of "telecaster", set an appropriate password and then update the UCCX server in the Cisco Desktop Administrator section. Select the option "CAD Configuration Setup" and scroll down to the section shown below (and truncated for space):
This whole process is laid out in the CAD setup guides and ensure that telecaster is functional. Telecaster itself does need certain rights which are laid out in the documentation as well.
Finally, as requested earlier here is the relevant section of the configuration of my AD integrated IPPA agent in my lab:
I apologize for the length of this post but wanted to try to cover as much of the issues laid out and how to resolve most of them. If you still have remaining issues, you know where to find me. Thank you for choosing Cisco Systems and I hope you have a good evening.
--
Sincerely,
Robert W. Rogier
TAC - UCC
Cisco Systems, Inc - Research Triangle Park, NC
