UCCE 11.5: Configuring new supervisor

[Slavik Bialik]

Hi all,

We started to use the UCCE 11.5 and we noticed that Cisco changed the mechanism of the supervisor configurations. In annoying way of course :)

In 10.x and 11.0, when you were to configure a new supervisor you can just go to the CCDM or Configuration Manager, select the agent you want to make a supervisor, tick the supervisor checkbox and choose the password and it instantly configuring a new user in the Active Directory for this newly fresh supervisor.

But now? God help me. Now we need to go first to the Active Directory itself, create manually the user, and only then go to the Configuration Manager / CCDM and choose the user that we created in the Active Directory and assign it to the agent that selected to be a supervisor.

Not only that, but now the supervisors are identified by a URI as a login name and not just a simple a login name (and I also ask myself: WHY?!), for example if my username is 'slavik' and my active directory domain name is 'domain.com', the supervisor's login name from now on will be: "slavik@domain.com". Which of course make an issue for us while using our custom agent desktop application, but I can live with that. The issue is more operational as we're giving support to customers with UCCE, and it's not a good way to operate the system if you need to do the those unnecessary configurations also on the Active Directory before you do the very necessary configurations in the ICM.

So what I'm actually asking is... is there a way around it? Maybe we missed some important point in the new version of UCCE. Is there a way to configure supervisors without creating a user in the active directory manually?

Thanks!

[geoff]

Is there a way around it? No.

From the 11.5 Release Notes:

Active Directory Account Requirement for Supervisors

You can now designate an agent as a supervisor, even if the agent's account is already configured as an administrator in the User List Tool. If you define an agent as a supervisor:

• If single sign-on is disabled either globally or for the agent you want to designate as a supervisor, the supervisor must have an Active Directory account. If the supervisor does not have an Active Directory account, the designation fails.

On the second point, you have a choice. You can use the UPN form slavik@domain.com or you can use DOMAIN\slavik.

The UPN form is preferred for access to CCE Admin.

I cannot quite remember how it worked, but my memory is if you used the UPN form then you could log in as a supervisor using either and log into CCE Admin with the UPN form; but if you created the supervisor as DOMAIN\slavik you could only log into the supervisor that way and could not use CCE Admin. Something weird like that.

Regards,
Geoff

[Slavik Bialik]

Hi Geoff, thanks for the reply!

My point in all of this is... it is a waste of our time now to go and configure every supervisor first in the Active Directory manually. In previous version it wasn't like that, it created the users in active directory automatically from the Configuration Manager. Is there no way around it?

[geoff]

I am sure that one of two things happened. Either some security conscious customers complained to Cisco that allowing ICM to create users in their Active Directory was verboten; or it was a requirement to go that route to match with SSO.

It is a bit of a pain, but I don't think you can work around it.

Regards,
Geoff

[Slavik Bialik]

Thanks Geoff, I can only guess that you're right. 

Basically, for every deployment we're setting to our client, we're creating a new domain and a new domain controller. So client won't really care about it. But I can totally understand clients that are using their own domain controller, never thought about it.

Thanks again.

[geoff]

Slavik,

It sounds like your company is an HCS (Cloud) provider. Is that true? Normally customers want to integrated ICM to their corporate AD. I remember the old days where ICM needed its own Domain and when Cisco introduced the hooks into corporate Domains I wondered "who would ever want to do that?". ;)

Regards.
Geoff

[Slavik Bialik]

Yes, I'm providing managed services over HCS infrastructure to our clients. There are few customers that asked us to deploy a single deployment for them only (for example 500/1000 Agents or 2000 Agents deployment), but most of them are based on the HCS deployments.

And yeah, I totally agree, that's exactly what I thought. Because it inserts some strange folders into the Active Directory that mentions the instance name and facility. I, of course, understand why, but.... it's ugly, heh ;)