Re: addPhone on UC 11.5 - security profile issue

stephan.steiner · ‎07-21-2016

Hi

I think there's a pretty nasty bug in AXL on UC 11.5. I'm trying to add phones (Jabber for Windows Devices), and I get my command rejected with a message "Security Profile is required for this device". That's weird because I can see the securityprofileName tag in my xml that I'm sending over the wire, but looking at the AXL log on CUCM, I see that the insert command lacks the fksecurityprofile value.

Here's the AXL command

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.cisco.com/AXL/API/11.5">

<soapenv:Header/>

<soapenv:Body>

<ns:addPhone sequence="10">

<phone>

<name>CSFTEST</name>

<description>Added phone SGRO</description>

<product>Cisco Unified Client Services Framework</product>

<class>Phone Template</class>

<ciscoSupportField>configurationfile=jabber-standard.xml</ciscoSupportField>

</desktopClient>

</vendorConfig>

<preemption>Disabled</preemption>

<lines>

<line>

<display>displöi</display>

<dirn>

<routePartitionName>p_phones</routePartitionName>

</dirn>

<consecutiveRingSetting>Flash Only</consecutiveRingSetting>

<userId>testenduser</userId>

</enduser>

</associatedEndusers>

<missedCallLogging>false</missedCallLogging>

</line>

</lines>

<phoneTemplateName uuid="{8E1A10FA-A52C-4435-A4EC-540D266C8C37}">Standard Client Services Framework</phoneTemplateName>

<userLocale>English United States</userLocale>

<callInfoPrivacyStatus>Default</callInfoPrivacyStatus>

<ignorePresentationIndicators>false</ignorePresentationIndicators>

<dndOption>Ringer Off</dndOption>

<alwaysUsePrimeLine>Default</alwaysUsePrimeLine>

<alwaysUsePrimeLineForVoiceMessage>Default</alwaysUsePrimeLineForVoiceMessage>

<callingSearchSpaceName uuid="{379DCBFB-069A-B6D7-A2EC-6E62BDB9940C}">css_internal</callingSearchSpaceName>

<devicePoolName uuid="{1B1B9EB6-7803-11D3-BDF0-00108302EAD1}">Default</devicePoolName>

<commonPhoneConfigName uuid="{AC243D17-98B4-4118-8FEB-5FF2E1B781AC}">Standard Common Phone Profile</commonPhoneConfigName>

<networkLocation>Use System Default</networkLocation>

<useTrustedRelayPoint>Default</useTrustedRelayPoint>

<securityProfileName uuid="{C6085E14-A32C-4C5E-A3D1-8DAF60D81594}">Cisco Unified Client Services Framework - Standard SIP Non-Secure Profile</securityProfileName>

<sipProfileName uuid="{FCBC7581-4D8D-48F3-917E-00B09FB39213}">Standard SIP Profile</sipProfileName>

<sendGeoLocation>false</sendGeoLocation>

<ringSettingIdleBlfAudibleAlert>Default</ringSettingIdleBlfAudibleAlert>

<ringSettingBusyBlfAudibleAlert>Default</ringSettingBusyBlfAudibleAlert>

<networkLocale>Switzerland</networkLocale>

<enableExtensionMobility>false</enableExtensionMobility>

<builtInBridgeStatus>Default</builtInBridgeStatus>

<hotlineDevice>false</hotlineDevice>

<presenceGroupName uuid="{AD243D17-98B4-4118-8FEB-5FF2E1B781AC}">Standard Presence group</presenceGroupName>

<unattendedPort>false</unattendedPort>

<requireDtmfReception>false</requireDtmfReception>

<rfc2833Disabled>false</rfc2833Disabled>

<certificateOperation>No Pending Operation</certificateOperation>

<deviceMobilityMode>Default</deviceMobilityMode>

<remoteDevice>false</remoteDevice>

<isDualMode>false</isDualMode>

<phoneSuite>Default</phoneSuite>

<phoneServiceDisplay>Default</phoneServiceDisplay>

<isProtected>false</isProtected>

<mtpRequired>false</mtpRequired>

<outboundCallRollover>No Rollover</outboundCallRollover>

<deviceTrustMode>Not Trusted</deviceTrustMode>

<requireOffPremiseLocation>false</requireOffPremiseLocation>

<name>CSFTEST</name>

<description>Added phone SGRO</description>

<product>Cisco Unified Client Services Framework</product>

<class>Phone Template</class>

<ciscoSupportField>configurationfile=jabber-standard.xml</ciscoSupportField>

</desktopClient>

</vendorConfig>

<preemption>Disabled</preemption>

<lines>

<line>

<display>displöi</display>

<dirn>

<routePartitionName>p_phones</routePartitionName>

</dirn>

<consecutiveRingSetting>Flash Only</consecutiveRingSetting>

<userId>testenduser</userId>

</enduser>

</associatedEndusers>

<missedCallLogging>false</missedCallLogging>

</line>

</lines>

<phoneTemplateName uuid="{8E1A10FA-A52C-4435-A4EC-540D266C8C37}">Standard Client Services Framework</phoneTemplateName>

<userLocale>English United States</userLocale>

<callInfoPrivacyStatus>Default</callInfoPrivacyStatus>

<ignorePresentationIndicators>false</ignorePresentationIndicators>

<dndOption>Ringer Off</dndOption>

<alwaysUsePrimeLine>Default</alwaysUsePrimeLine>

<alwaysUsePrimeLineForVoiceMessage>Default</alwaysUsePrimeLineForVoiceMessage>

<callingSearchSpaceName uuid="{379DCBFB-069A-B6D7-A2EC-6E62BDB9940C}">css_internal</callingSearchSpaceName>

<devicePoolName uuid="{1B1B9EB6-7803-11D3-BDF0-00108302EAD1}">Default</devicePoolName>

<commonPhoneConfigName uuid="{AC243D17-98B4-4118-8FEB-5FF2E1B781AC}">Standard Common Phone Profile</commonPhoneConfigName>

<networkLocation>Use System Default</networkLocation>

<useTrustedRelayPoint>Default</useTrustedRelayPoint>

<securityProfileName uuid="{C6085E14-A32C-4C5E-A3D1-8DAF60D81594}">Cisco Unified Client Services Framework - Standard SIP Non-Secure Profile</securityProfileName>

<sipProfileName uuid="{FCBC7581-4D8D-48F3-917E-00B09FB39213}">Standard SIP Profile</sipProfileName>

<sendGeoLocation>false</sendGeoLocation>

<ringSettingIdleBlfAudibleAlert>Default</ringSettingIdleBlfAudibleAlert>

<ringSettingBusyBlfAudibleAlert>Default</ringSettingBusyBlfAudibleAlert>

<networkLocale>Switzerland</networkLocale>

<enableExtensionMobility>false</enableExtensionMobility>

<builtInBridgeStatus>Default</builtInBridgeStatus>

<hotlineDevice>false</hotlineDevice>

<presenceGroupName uuid="{AD243D17-98B4-4118-8FEB-5FF2E1B781AC}">Standard Presence group</presenceGroupName>

<unattendedPort>false</unattendedPort>

<requireDtmfReception>false</requireDtmfReception>

<rfc2833Disabled>false</rfc2833Disabled>

<certificateOperation>No Pending Operation</certificateOperation>

<deviceMobilityMode>Default</deviceMobilityMode>

<remoteDevice>false</remoteDevice>

<isDualMode>false</isDualMode>

<phoneSuite>Default</phoneSuite>

<phoneServiceDisplay>Default</phoneServiceDisplay>

<isProtected>false</isProtected>

<mtpRequired>false</mtpRequired>

<outboundCallRollover>No Rollover</outboundCallRollover>

<deviceTrustMode>Not Trusted</deviceTrustMode>

<requireOffPremiseLocation>false</requireOffPremiseLocation>

<enableCallRoutingToRdWhenNoneIsActive>false</enableCallRoutingToRdWhenNoneIsActive>

</phone>

</ns:addPhone>

</soapenv:Body>

</soapenv:Envelope>

And this is the insert command that is generated from it

insert into Device ( tkDeviceProtocol,tkPacketCaptureMode,fkMatrix_Presence,tkNetworkLocation,tkStatus_MLPPIndicationStatus,tkProtocolSide,tkStatus_DeviceMobilityMode,fkPhoneTemplate,NetworkHoldMOHAudioSourceID,RFC2833Disabled,fkCallingSearchSpace,tkdevicetrustmode,tkStatus_AlwaysUsePrimeLineForVM,tkStatus_BuiltInBridge,enableCallRoutingToRdWhenNoneIsActive,tkOutboundCallRollover,requireCERLocation,isprotected,remoteDevice,unattended_port,PacketCaptureDuration,AllowHotelingFlag,tkCertificateOperation,fkLocation,AllowCTIControlFlag,fkCommonPhoneConfig,pkid,tkStatus_UseTrustedRelayPoint,tkProduct,tkCountry,mTPRequired,requireDTMFReception,tkRingSetting_DND,fkDevicePool,tkPhonePersonalization,tkSIPCodec_MTPPreferredOrigCodec,tkStatus_AlwaysUsePrimeLine,fkSIPProfile,UseDevicePoolCgpnIngressDN,tkPreemption,SendGeoLocation,hotlinedevice,Description,tkstatus_joinacrosslines,ignorePI,Name,tkUserLocale,retryVideoCallAsAudio,tkDndOption,tkClass,tkPhoneServiceDisplay,UserHoldMOHAudioSourceID ) values ( '11','0','ad243d17-98b4-4118-8feb-5ff2e1b781ac','2','0','1','2','8e1a10fa-a52c-4435-a4ec-540d266c8c37','51','f','379dcbfb-069a-b6d7-a2ec-6e62bdb9940c','0','2','2','f','0','f','f','f','f','0','f','1','29c5c1c4-8871-4d1e-8394-0b9181e8c54d','t','ac243d17-98b4-4118-8feb-5ff2e1b781ac','0ce01087-aeb7-01e1-220c-3871f3bc5d57','2','390','59','f','f','5','1b1b9eb6-7803-11d3-bdf0-00108302ead1','3','1','2','fcbc7581-4d8d-48f3-917e-00b09fb39213','t','0','f','f','Added phone SGRO','0','f','CSFTEST','1','t','0','253','3','1' )

as you can see, the securityProfileName is in the xml, and it matches the AXL schema reference for CUCM 11.5, but on the SQL it is missing. There's also no lookup of a security profile from the database if we look at the AXL log yet again:

2016-07-21 11:39:20,701 DEBUG [http-bio-443-exec-16] axlapiservice.AddPhoneHandler - select tkModel from TypeProduct where typeproduct.enum='390'

2016-07-21 11:39:20,701 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - select tksupportsfeature, tkdeviceprotocol,param from ProductSupportsFeature where tkproduct='390' and tkdeviceprotocol in ('11',99)

2016-07-21 11:39:20,702 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 supports feature 116

2016-07-21 11:39:20,703 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - getPkid Query is :select pkid from CallingSearchSpace where my_lower(name ) =my_lower('css_internal' )

2016-07-21 11:39:20,704 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - getPkid Query is :select pkid from DevicePool where my_lower(name ) =my_lower('Default' )

2016-07-21 11:39:20,705 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 supports feature 104

2016-07-21 11:39:20,705 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,706 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - getPkid Query is :select pkid from CommonPhoneConfig where my_lower(name ) =my_lower('Standard Common Phone Profile' )

2016-07-21 11:39:20,707 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,708 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - getPkid Query is :select pkid from Location where my_lower(name ) =my_lower('Hub_None' )

2016-07-21 11:39:20,709 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 does not support feature 34

2016-07-21 11:39:20,709 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,710 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,711 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - getPkid Query is :select pkid from PhoneTemplate where my_lower(name ) =my_lower('Standard Client Services Framework' )

2016-07-21 11:39:20,712 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - select enum from TypeUserLocale where name='English United States'

2016-07-21 11:39:20,713 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,713 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 does not support feature 18

2016-07-21 11:39:20,714 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 does not support feature 79

2016-07-21 11:39:20,714 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 does not support feature 78

2016-07-21 11:39:20,714 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Product 390 does not support feature 53

2016-07-21 11:39:20,715 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,716 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,717 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - Inside addTkdataAXIS utils part

2016-07-21 11:39:20,718 DEBUG [http-bio-443-exec-16] axlapiservice.Handler - getPkid Query is :select pkid from Matrix where my_lower(name ) =my_lower('Standard Presence group' )

The same command used to work fine on CUCM 10.5.

dstaudt · ‎09-09-2016

Are you still seeing this issue? The following seems to work OK on my 11.5 system. You may need to go ahead and open a DevNet Developer Support ticket:

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:ns="http://www.cisco.com/AXL/API/11.5">

<soapenv:Header/>

<soapenv:Body>

      <ns:addPhone>

            <phone>

              <name>CSFdstaudt2</name>

              <product>Cisco Unified Client Services Framework</product>

              <model>Cisco Unified Client Services Framework</model>

              <class>Phone</class>

              <protocol>SIP</protocol>

              <protocolSide>User</protocolSide>

              <devicePoolName uuid="{1B1B9EB6-7803-11D3-BDF0-00108302EAD1}">Default</devicePoolName>

              <securityProfileName uuid="{C6085E14-A32C-4C5E-A3D1-8DAF60D81594}">Cisco Unified Client Services Framework - Standard SIP Non-Secure Profile</securityProfileName>

              <sipProfileName uuid="{FCBC7581-4D8D-48F3-917E-00B09FB39213}">Standard SIP Profile</sipProfileName>

            </phone>

      </ns:addPhone>

</soapenv:Body>

</soapenv:Envelope>

------------------------------

<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">

<soapenv:Body>

      <ns:addPhoneResponse xmlns:ns="http://www.cisco.com/AXL/API/11.5">

        <return>{A28B323B-6FB1-53D2-6D0A-C00E7B3350EF}</return>

      </ns:addPhoneResponse>

</soapenv:Body>

</soapenv:Envelope>

stephan.steiner · ‎10-04-2016

Hmm.. I seem not to get any notifications of replies.. hence my late reply.

I did open a devnet case.. turns out my command is the problem. and the response is just not very helpful. I sent

<class>Phone Template</class>

but to addPhone. And while addPhone requires the securityProfile, the phone template does not. So it was a problem with me initially using actual phones to create copies from, and then going to templates (they don't eat any licenses..), but not adapting the class.