SSO CUCM - Entra Id

[Juan Delgado Gutierrez]

Hello All, 

Im trying to set the SSO between CUCM and Entra Id and i would like to know if in the SAML request the CUCM always sends the “userid” or there js a way (i think it’s not possible vía GUI but maybe by CLI) to modify this parameter and send the email or extension. 

Thanks you very much in advance. 
Juan 

[Jonathan Schulenberg]

You have it backward: the IdP includes whatever the user identifier is in the SAML response given to the client. CUCM compares this value, in the uid attribute, to the user identifier in CUCM. That can be an email address or other valid URI. If you’re syncing accounts from LDAP, you would need to change the username attribute mapping away from sAMAccountName to mail or UPN under System > LDAP

[Juan Delgado Gutierrez]

Many thanks for your answer Jonathan. 

I have a doubt. According to your explanation, the IdP passes to the CUCM all the information regarding that user and  Call Manager will be in charge of reviewing this information to see if any field matches the uid. Correct? The point is that the uid must be the user's extension and in the IdP we have the email. And this must remain in that way. From what you say, I understand that I cannot make the uid in CUCM be the mail field but i could make the IdP send what it is populated in the Extension field to match the uid in CUCM. Correct? The ideal solution should be to change the uid in the CUCM to take what is set on mail field. 

Again, thanks for your help. 

Juan

[Jonathan Schulenberg · Accepted solution]

...the IdP passes to the CUCM all the information regarding that user

---

Technically the IdP sends the SAML response to the client which then forwards it on to CUCM; the IdP and SP, such as CUCM, never communicate directly.

---

Call Manager will be in charge of reviewing this information to see if any field matches the uid.

---

Not quite. The SAML response must contain a uid attribute that matches a username in CUCM. The CUCM username attribute supports URIs, so it can be the email address. M365/Entra best practices call for the userPrincipalName to be the user's email address, so that's the most common approach. Mail doesn't enforce uniqueness; multiple accounts could have the same mail address, but not the same UPN.

---

The point is that the uid must be the user's extension and in the IdP we have the email. And this must remain in that way.

---

If you meant that the CUCM username must remain the user's numeric extension then you'll have to configure the IdP to map that value into the uid attribute of the SAML response. Be careful about duplicates though if that numeric extension attribute doesn't enforce uniqueness in Entra.

---

The ideal solution should be to change the uid in the CUCM to take what is set on mail field.

---

This is possible. Again, UPN is more common than mail since it enforces unique values.

---

[Juan Delgado Gutierrez]

Thank you very much for your support Jonathan.