Enabling SSO on Expressway E Without SSO Enabled on Internal UCM

[vincent.mignano]

We have recently been asked to by our ISD group to secure our Mobile Remote Access authentication flow. We currently authenticate thru the Expressway E to the C to the UCM with AD integration. We are looking to turn on SSO on the Expressway E to authenticate with an External IdP before going through the Firewall Traversal as it is deemed a security risk not to allow access into the internal network without authentication.

I have read the deployment guide and cant determine if I need to have SSO turned on for the entire UC environment.

Also, the expressway E does not had the MRA Access Control configurations to change it to SSO.

Our UC environment is all 12.5 and our Expressway 14.0.5.

Please assist.

Thanks in advance

[Roger Kallberg]

I’m pretty sure that you’ll need to turn SSO on for your entire CM system, including your MRA system. The best option would be for you to get a service window and test it out yourself to know for sure. On your other part of your question, from what I know you configure this on the C node, not on the E. The E gets this configuration from the C.

[vincent.mignano]

Hey Roger,

Thanks for the response. One follow up question to that, would we have to change the Jabber desktop application install configuration to recognize SSO or does Jabber do that on its own?

[Roger Kallberg · Accepted solution]

Jabber will detect that SSO is in use without any change to configuration. That is given that you have not altered the default value in the configuration file to turn off SSO on the client side. For more information on what options there are in the configuration file search for Jabber parameter reference guide, it holds all available parameters and an explanation on what each does.

[vincent.mignano]

Thanks for the assistance!