Webex SSO iDP initiated login

[clarkst12]

Our Webex is fully integrated in with the Control Hub.  Our SAML provider has enabled both iDP and SP initiated logons and SSO Authentication is configured in Control Hub, however it appears that iDP initiated doesn't work.   Our Cisco rep told us six months ago that iDP works for legacy Webex (non-Control Hub), but not for Control Hub.

SP initiated does work fine.  Windows users with a valid Kerberos ticket can browser directly to our Service Now instance and SN knows who they are without prompting.  However, if they go to ourcompany.webex.com, they need to click on Login, provide their email, then it logs them in (which, as I understand, would be exactly how it would work with SP-initiated.

Has anyone gotten Control Hub authentication to work with iDP initiated SSO?

[support.in]

Hi Team,

Webex didn't support IDP initiated login at SAML 2 Configuration.

Try to Configure SSO (Saml2 ) NetIQ Access manager 5.0.1

IDP Provider: NetIQ Access Manager

Service provider: Webex Cisco Meting 

[Roger Kallberg]

@support.in Not sure what your question is, would you mind to please clarify?

[pcookhayboo]

I'm in the same situation. I asked support and iDP initiated login not available/supported. 

If I had known all the limitations of control hub I would have stayed with Site Administration manged meetings Tenant. Identity, provisioning and API access are all more difficult now that we've switched.  

I created a request for it here if you want to vote  https://ciscocollabcustomer.ideas.aha.io/ideas/WXCUST-I-339

[clarkst12]

I honestly have a hard time believing that they don't support something as basic as this.

[pcookhayboo]

From my ticket at the beginning of the year. 

[DerekD]

I only dabble in SAML issues at our site (someone else is our primary Shib guy), but whenever the topic of IdP Initiated SSO is discussed on the Shibboleth mailing list, it is my understanding that Scott Cantor (contributing author for the SAML spec) says that it was a bad idea and should be avoided.

Here is one post I found real quick - https://lists.oasis-open.org/archives/saml-dev/201605/msg00009.html

Also, see the "Overview" section of the a shibboleth wiki page at <https://wiki.shibboleth.net/confluence/display/IDP4/UnsolicitedSSOConfiguration>

P.S. Not posting the above to start a forum war, just wanted to pass along that a key person involved in the spec has an opinion on the subject. :)