This document outlines the basic steps required for configuring the Idp(ADFS) to enable SAML SSO on Cisco UC products like Communications Manager , Unity connection ,IM&Presence server 10.x.
Per your instructions, you state to replace sections of the custom rule with the ADFS and the CUCM FQDN. What is there are more than one CUCM node in the cluster? How does this redundancy work ? You mention to repeat steps 1 - 16 for Unity Connection, but I am wondering if steps 1 - 16 need to be performed for each CUCM / UCXN node in the cluster?
Custom Claim rule is required to send claims from ADFS to CUCM/UCXN based on values that are extracted from a Lightweight Directory Access Protocol (LDAP) attribute store using a custom LDAP filter. Here are select "uid" for outgoing claim in step 11.
Regarding the redundancy, You need to create a Relying party trust entry in ADFS for each CUCM and UCXN servers. Ex: if you have 4 CUCM and 2 UCXN , you need to create all 6 Relying party trust in ADFS with steps 1-16 .
I know this topic is a few months old but hopefully someone is still monitoring it. My question is related to the statement about creating multiple relying party trusts. I am using a SAN certificate signed by my enterprise CA and the certificates are working properly on all servers. I can create the first relying party trust and it works properly. The problem is that since the cert is the same across the cluster it will not let me add a second rule, it tells me the signing certificate of the relying party trust is not unique. If I can have all hostnames in the claim rule this would fix the issue. I have tried different certificates on each server but I would like to use something other than the hostname to access the server and using a single cert does not let me do this. Do you know a way to add multiple hostnames to the claim rule to make it work?
I have the same issue in my environment. We are using CUCM with a multi-SAN certificate. I am finding the same issue with ADFS not letting me add multiple relay trusts with the same certificate (error: "MSIS7613: The signing certificate of the relying party trust is not unique across all relying party trusts in AD FS configuration"). However we are running ADFS 2.1 on Windows 2012. The ADFS 2.0 Update Rollup #3 (http://support.microsoft.com/?id=2790338) only applies to Windows 2008, and not Windows 2012.
I have searched for a while to find an appropriate update for Windows 2012 and haven't found anything. I have found a solution on a blog that will work for Windows 2012. The author mentioned that there is no update for Windows 2012 yet. His solution is basically to install this update on a 2008 server and copy/edit the powershell scripts to run on 2012.
Here is the blog: https://emnavarro02.wordpress.com/2014/01/28/windows-server-2012-adfs-2-1-erro-msis7613the-signing-certificate-of-the-relying-party-trust-is-not-unique-across-all-relying-party-trusts-in-ad-fs-2-0-configuration/
I have tested this in my environment. When I ran the .\PostReleaseSchemaChanges.ps1 script, I had 1 error about copying the DLL and cer file to a directory that didn't exist (error on line 42 of the script). Even though I had this error, ADFS works correctly for me now. I can add multiple relay trusts for CUCM with the same cert.
Getting Started
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:
