Single Sign On. Configuration Checklist for Single Sign On CHAPTER

Transcription

1 CHAPTER 39 The single sign on feature allows end users to log into a Windows client machine on a Windows domain, then use certain Cisco Unified Communications Manager applications without signing on again. For more information about the single sign on feature, refer to the Cisco white paper A complete guide for installation, configuration and integration of CUCM8.5 with Open Access Manager and Active Directory for SSO. This chapter, which provides information on the single sign on feature for Cisco Unified Communications Manager, contains the following topics: Configuration Checklist for, page 39-1 Introducing for Cisco Unified Communications Manager, page 39-2 System Requirements for, page 39-2 Installing and Activating, page 39-3 Configuring, page 39-3 Related Topics, page 39-7 Configuration Checklist for The single sign on feature allows end users to log into a Windows client machine, then use certain Cisco Unified Communications Manager applications without signing on again. 39-1

2 Introducing for Cisco Unified Communications Manager Chapter 39 Table 39-1 provides a checklist for configuring single sign on in your network. Use Table 39-1 in conjunction with the Related Topics section on page For information about configuring single sign on with Cisco Unified Communication interface for Microsoft Office Communicator, refer to the Cisco Unified Communication interface for Microsoft Office Communicator documentation. Table 39-1 Configuration Checklist Configuration Steps Step 1 Ensure that your environment meets the requirements described in the System Requirements for section on page 39-2 Step 2 Step 3 Step 4 Provision the OpenAM server in Active Directory, then generate keytab files. Note If your Windows version does not include the ktpass tool for generating keytab files, then you must obtain it separately. Import the OpenAM server certificate into the Cisco Unified Communications Manager tomcat-trust store. Configure Windows single sign on with Active Directory and OpenAM. Related Topics and Documentation Microsoft Active Directory documentation Importing the OpenAM Certificate into Cisco Unified Communications Manager section on page 39-4 Configuring Windows with Active Directory and OpenAM section on page 39-4 Step 5 Configure client browsers for single sign on. Configuring Client Browsers for Single Sign On section on page 39-4 Step 6 Enable single sign on in Cisco Unified Communications Manager. Running CLI Commands for Single Sign On section on page 39-5 Introducing for Cisco Unified Communications Manager The single sign on feature allows end users to log into Windows, then use the following Cisco Unified Communications Manager applications without signing on again: User Options Pages Cisco Unified Communication interface for Microsoft Office Communicator System Requirements for The following single sign on system requirements exist for Cisco Unified Communications Manager: Cisco Unified Communications Manager release 8.5(1) on each server in the cluster The feature requires the following third-party applications: Microsoft Windows Server 2003 or Microsoft Windows Server 2008 Microsoft Active Directory 39-2

3 Chapter 39 Installing and Activating ForgeRock Open Access Manager (OpenAM) version 9.0 The single sign on feature uses Active Directory and OpenAM in combination to provide single sign on access to client applications. These third party products must meet the following configuration requirements: Active Directory must be deployed in a Windows domain-based network configuration, not just as an LDAP server. The OpenAM server must be accessible on the network to all client systems and the Active Directory server. The Active Directory (Domain Controller) server, Windows clients, Cisco Unified Communications Manager, and OpenAM must be in the same domain. DNS must be enabled in the domain. No third-party products may be installed on the Cisco Unified Communications Manager server. The clocks of all the entities participating in SSO must be synchronized See the third-party product documentation for more information about those products. Installing and Activating After you install Cisco Unified Communications Manager 8.5(1), your network can support single sign on if you perform the necessary configuration tasks. For information on configuration tasks that you must perform, see the Configuration Checklist for section on page Configuring This section contains information on the following topics: Configuring OpenAM, page 39-3 Configuring Windows with Active Directory and OpenAM, page 39-4 Configuring Client Browsers for, page 39-4 Running CLI Commands for, page 39-5 Tip Before you configure single sign on, review the Configuration Checklist for section on page Configuring OpenAM Perform the following tasks using OpenAM: Configure policies in OpenAM for the following: CUCM User and UDS web application Query Parameters Configure a J2EE Agent Profile for Policy Agent 3.0. Configure a Windows Desktop SSO login module instance. 39-3

4 Configuring Chapter 39 Configure Login Form URI and OpenAM Login URL for the PA. Disable local user profiles. Importing the OpenAM Certificate into Cisco Unified Communications Manager Because communication between Cisco Unified Communications Manager and OpenAM is secure, you must obtain the OpenAM security certificate and import it into the Cisco Unified Communications Manager tomcat-trust store. Configure the OpenAM certificate to be valid for 5 years. For information about importing certificates, see the Cisco Unified Communications Operating System Administration Guide. Configuring Windows with Active Directory and OpenAM This section describes how to configure Windows single sign on with Active Directory and OpenAM. This procedure allows Cisco Unified Communications Manager to authenticate with Active Directory. Procedure Step 1 Step 2 Step 3 Step 4 In Active Directory, create a new user with the OpenAM Enterprise host name (without the domain name) as the User ID (login name). Create keytab files on the Active Directory server. Export the keytab files to the OpenAM system. In OpenAM, create a new authentication module instance with the following configuration: The type is Windows Desktop SSO. The realm attributes are determined as follows: Service Principal: Enter the principal name that you used to create the keytab file. Keytab File Name: Enter the path where you imported the keytab file. Kerberos Realm: Enter the domain name. Kerberos Server Name: Enter the FQDN of the Active Directory server. Authentication level: Enter 22. Configuring Client Browsers for To use single sign on for a browser-based client application, you must configure the web browser. The following sections describe how to configure client browsers to use single sign on: Configuring Internet Explorer for, page 39-5 Configuring FireFox for, page

5 Chapter 39 Configuring Configuring Internet Explorer for The single sign on feature supports Windows clients running Internet Explorer version 6.0 and higher. Do the following tasks to configure Internet Explorer to use single sign on: Select the Integrated Windows Authentication option. Create a custom security level configured as follows: Select the Automatic Logon Only in Intranet Zone option Select all of the options for sites. Add OpenAM to the local zone, if it not already added. Do the following tasks for Internet Explorer 8.0 running on Windows 7: Disable Protected Mode. Under registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\, add DWORD value SuppressExtendedProtection - 0x02. Configuring FireFox for The single sign on feature supports Windows clients running FireFox version 3.0 and higher. To configure Firefox to use single sign on, enter the trusted domains and URLs that are permitted to engage in SPNEGO Authentication with the browser into the network.negotiate-auth.trusted-uris preference. Running CLI Commands for The following sections describe the CLI commands that configure single sign on: utils sso enable, page 39-5 utils sso disable, page 39-6 utils sso status, page 39-7 utils sso enable This command enables and configures single sign on. Command Syntax utils sso enable Usage Guidelines This command starts a single sign on configuration wizard. You get prompted for the information described in Table Answer each prompt, then press Enter to continue. Caution Enabling single sign on restarts the Cisco Unified Communications Manager web server (Tomcat). You must run this command on all nodes in a cluster. 39-5

6 Configuring Chapter 39 Table 39-2 Configuration Wizard Prompts Information That the Prompt Requests URL of the Open Access Manager (OpenAM) server Relative path where the policy agent should be deployed Name of the profile configured for this policy agent Password of the profile. Login module instance name configured for Windows Desktop SSO Description The URL that you configured for the OpenAM server. Enter the path on the Cisco Unified Communications Manager where the policy agent will get deployed. This path is relative to the agentapp directory. This path must match the path that you configured for the J2EE Agent Profile for Policy Agent 3.0. The name of the profile that you created for this policy agent in OpenAM. The name of the login module instance for Windows Desktop SSO that you configured in OpenAM. Example admin:utils sso enable ***** W A R N I N G ***** This command will restart Tomcat for successful completion. This command needs to be executed on all the nodes in the cluster. Do you want to continue (yes/no): yes Enter URL of the Open Access Manager (OpenAM) server: Enter the relative path where the policy agent should be deployed: agentapp Enter the name of the profile configured for this policy agent: CUCMUser Enter the password of the profile name: ******** Enter the login module instance name configured for Windows Desktop SSO: CUCMUser Validating connectivity and profile with AM Server: Valid profile Enabling SSO... This will take upto 5 minutes SSO Enable Success Please make sure to execute this command on all the nodes in the cluster. utils sso disable This command disables single sign on. Command Syntax utils sso disable Usage Guidelines Caution Disabling single sign on restarts the Cisco Unified Communications Manager web server (Tomcat). You must run this command on all nodes in a cluster. 39-6

7 Chapter 39 Related Topics utils sso status This command displays the status and configuration parameters of single sign on. Command Syntax utils sso status Related Topics Configuration Checklist for, page 39-1 Introducing for Cisco Unified Communications Manager, page 39-2 System Requirements for, page 39-2 Installing and Activating, page 39-3 Configuring, page

8 Related Topics Chapter