SSO with CUCM 10.5 and ADFS 3.0

[mbaker33]

Hello,

We recently updated our CUCM/CUPS/CUC system to 10.5 in order to take advantage of the SSO capabilities that are now built in.  All of the documentation points to ADFS 2.0, and we have an ADFS 3.0 implementation.  I am trying to figure out if this is an issue with the Claims Rule code, or if CUCM simply doesn't support ADFS 3.0.  

We have gone through the following links:

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/10x/administration/guide/10xcucsagx/10xcucsag112.html#32035

https://supportforums.cisco.com/video/12155556/cucm-10x-samlsso-adfs20

But we are having trouble configuring the Custom Claims Rule, we get the attached error.

The rule we are applying is as follows, but with actual server names:

"c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
 => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, Originallssuer = c.Originallssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:3.0:nameid-format: transient", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] = "http://adfsserver.domain.com/adfs/com/adfs/service/trust", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "phoneservername.domain.com");"

[carlo alberto michelotti]

Hi, did you solved the issue ?

thanks,

C.

[Roger Kallberg]

The most common reasons for this to not work is that the claim rule is not setup correctly, or that the time between the client, IdP system and CUCM isn't in sync. For the claim rule look at the example below.

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/windowsaccountname"]
 => issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:2.0:nameid-format:transient", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/namequalifier"] = "http://<FQDN of your ADFS>/adfs/services/trust", Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] = "<FQDN of your CM Pub>");

This document is still valid, even if it says ADFS 2.0 it works with later versions. We use ADFS 4.0 as an example. Configure Single Sign-On using CUCM and AD FS 2.0 (Windows Server 2008 R2) - Cisco

I would also recommend you to read through this document in it's entirety, even is it is somewhat lengthy. SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 11.5(1) - Cisco

[carlo alberto michelotti]

Hi all, just for share my solution that have worked for my case.

my cucm have hostname with the uppercases and in  my custom claim rule into ADFS I have use lowecase for cucm host name.

Once I have corrected the hostname in the custom rule with UPPERCASEs  the sso test is passed