Turn Off - SSO - Call Manager Jabber and Unity

[Jes80]

hi Expert,

What is impact if we turn off SSO for UCM, Jabber, and Unity, we have 1000 users run on Jabber desktop.

- Do we need to change any Jabber XML file and other setting in Unity ?

UCM /CUC version 12.5

Thanks,

J

[Roger Kallberg]

No impact other than that your users would need to manually login. Both CM and CUC has setup for SSO, so you’ll need to touch both of these to turn off SSO. There is no setting as such in the Jabber configuration that needs to be altered.

[Jonathan Schulenberg]

Fair warning that this has not traditionally gone well. Either enabling or disabling SAML SSO sometimes requires the user to logout and back in to Jabber, if not perform a reset of the client app.

Please reconsider your plan here; SSO is a good thing.

[Jes80]

Hi Roger and Jonathan,

Thanks for response.  I read in forum , there is something like these , we need to be aware of ?

"After disabling SSO on jabber-config.xml (SSO_Enabled) still seeing jabber getting the list of UDS servers and trying to find SSO services available. "

Beside this above, what else I need to aware of? 

I am planning to enable SSO for UCM, Unity for 2 days , just for quick testing on user experince, then disable it for review.

Tks,

J

[Roger Kallberg]

There is a setting in the Jabber configuration that can turn off the use of SSO, however this would not be the the same as disabling SSO altogether. On your other question, Jabber will always use the UDS service, I don’t see how that would be related to SSO?

[Jes80]

Thanks Roger,

I understand I will disable from Call Manager and Unity. 

However as soon as I turn on SSO in UCM and CUC, will this setting appear on Jabber -config XML ?

Rgds,

J

Do I need to turn off this setting for SSO on Jabber as soon as I turn off SSO on UCM/CUC?

[Roger Kallberg · Accepted solution]

There is nothing that will automatically change in the Jabber configuration file when you setup and enable SSO. Any change(s) done to the configuration file needs to be manually made. Again there is no need to make any change(s) to the configuration file when you setup and enable SSO.

I agree with Jonathan on that it’s a bad plan to turn SSO on for a short period in a production environment and then turn it off.

[Jonathan Schulenberg]

---

I am planning to enable SSO for UCM, Unity for 2 days , just for quick testing on user experince, then disable it for review.

---

Do this sort of thing in the lab - not production! You're just asking for trouble IMO.

On a related note, if you're going to enable features to improve the user experience you should also look at CUCM/CUC/Expressway OAuth, CUCM SIP OAuth, and CUCM Push Notifications / Cloud Onboarding. OAuth is independent of SSO but is especially useful with it because the SAML cookie often expires in a day or less; OAuth allows the app to function without requiring the user authenticate to the IdP as often (up to 60 days, by default). Migrating from Jabber to the Webex app would also be a great idea in the long run; that's where Cisco is investing R&D these days.

[Jes80]

Agreed, however we dont have a lab that replicate this.  So we plan to turn it on SSO quickly on UCM/CUC and turn it off in 2 days.

We just want to anticipate what else we need to clean , after we turn off the SSO in UCM/CUC after that 2 days ?

I read in forum we need to clean the Jabber-config.xml, as it may trigger/save the SSO config in XML. But what else we need to aware to turn off, right after disable UCM /CUC SSO?

tks,

J