Configuration · guide

Setting up single sign-on for UCCE and Finesse with Cisco Identity Service

Cisco Unified Contact Center Enterprise

Verified 2026-10-02 · 74 sources · tier 2

For Contact center engineers running Unified CCE 15.0(1) on premises, and the identity team that owns its SAML 2.0 identity provider..

In Unified CCE 15.0(1), the single sign-on capable components for agents and supervisors are the Cisco Finesse desktop, Unified Intelligence Center, Live Data and Unified CCE Administration 66. Cisco's configuration flow installs Cisco IdS, installs and configures the identity provider, configures System Inventory and Cisco IdS, registers and tests the components, chooses the SSO mode and then enables users, and the identity provider must support SAML 2.0 19 39.

Before you start

Unified CCE single sign-on runs in one of 3 modes: Non-SSO, Hybrid or SSO 63. Non-SSO mode continues to use existing Active Directory-based and local authentication without single sign-on, so agents are unaffected until you change the mode 52.

Prerequisites:

The identity provider supports SAML 2.0 39.
HTTPS is enabled across the contact center enterprise solution 36.
Cisco IdS and the identity provider are time-synchronized, and Cisco recommends synchronizing both to an NTP server 53.
If the deployment is already SSO-enabled and moving to 15.0(1), Cisco IdS must also be at 15.0(1), and Reverse Proxy Installer 15.0(1) and IdS 15.0(1) are installed before the upgrade 40.
Cisco advises CA-signed application and root certificates to eliminate browser security warnings at each SSO sign-in 17.

Inventory what single sign-on will not cover: 12 34 21

Administrators: Unified CCE 15.0(1) single sign-on covers agents and supervisors only 12.
Cisco Finesse IP Phone Agent (FIPPA) users, because single sign-on does not support FIPPA 34.
Cisco Finesse Desktop Chat, which single sign-on does not support 21.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Are you moving every agent and supervisor to single sign-on at once, or phasing them in?

Which identity provider issues the SAML assertions?

Where does Cisco Identity Service (IdS) run?

Do agents use Enterprise Chat and Email (ECE) inside the Finesse desktop?

Four questions. One permanent page you can send to your manager.

Step 1 Confirm the prerequisites

Do

Confirm that the identity provider supports SAML 2.0 39 and that HTTPS is enabled across the solution 36. Synchronize Cisco IdS and the identity provider to an NTP server 53. If you are upgrading an SSO-enabled deployment to 15.0(1), install Reverse Proxy Installer 15.0(1) and IdS 15.0(1) first 40. Because the Cisco IdS token mechanism changed in 12.6(2), agents must sign out and back in to the Finesse desktop after Cisco IdS is upgraded 71. Keep FIPPA users, Finesse Desktop Chat and administrators out of your cutover plan, because single sign-on does not support them 34 21 12.

Verify

The CCE 15.0(1) compatibility matrix lists AD FS 5.0 on Windows Server 2022 and 2019, AD FS 4.0 on Windows Server 2016 and AD FS 3.0 on Windows Server 2012 R2 as supported identity providers 11. The same matrix states that Unified CCE supports all SAML 2.0 compliant identity providers 14. Suggested check: confirm that every user who cannot move to single sign-on has a documented plan that keeps them on their current sign-in.

Step 2 Install the Cisco IdS cluster

Coresident with Unified Intelligence Center and Live Data (2000 Agent design)

Do

Cisco's configuration flow installs Cisco IdS after the CCE release is installed and before the identity provider is installed and configured 19. In the 2000 Agent reference design, Cisco IdS is coresident with Unified Intelligence Center and Live Data on a single VM, so deploy it that way 42. A Cisco IdS cluster has a publisher node that can perform any configuration and token operation and a subscriber node whose permitted operations depend on whether the publisher is connected 44.

Verify

Sign in to the Cisco IdS administration console at https://:8553/idsadmin 41. The Identity Service Management Nodes page shows the publisher and subscriber node status 43.

Rollback

Suggested rollback: remove the newly deployed virtual machines, or restore the snapshots you took before the install.

On its own VMs (4000, 12000 and 24000 Agent designs)

Do

Cisco's configuration flow installs Cisco IdS after the CCE release is installed and before the identity provider is installed and configured 19. In the 4000, 12000 and 24000 Agent reference designs, Cisco IdS runs on a standalone VM, so deploy it that way 46. The publisher node can perform any configuration and token operation, and the subscriber node's permitted operations depend on whether the publisher is connected 44.

Verify

Sign in to the Cisco IdS administration console at https://:8553/idsadmin 41. The Identity Service Management Nodes page shows the publisher and subscriber node status 43.

Rollback

Suggested rollback: decommission the newly deployed virtual machines, since nothing has been pointed at them yet.

Step 3 Set the Principal AW and point System Inventory at Cisco IdS

Do

On the Unified CCE Administration Inventory page, set one Administration Workstation as the Principal AW, which runs periodic background tasks including SSO management 55. In System Inventory, choose the Cisco IdS machine in the Default Identity Service field 49.

Verify

Suggested check: reopen the inventory page and confirm that both settings you made in this step are saved.

Rollback

Suggested rollback: revert the inventory changes you made in this step.

Step 4 Make Finesse trust the Cisco IdS certificates

Do

When SSO is enabled, the certificates of all Cisco IdS nodes must be imported into the Finesse trust store 72. Export the tomcat certificate of each Cisco IdS node from Cisco Unified OS Administration, and upload it to each Finesse node as tomcat-trust under Security > Certificate Management 32. Updating the Finesse tomcat-trust certificate causes a temporary outage because it affects the Cisco Finesse Notification Service, so schedule the work accordingly 73. Reboot each Cisco Finesse server to apply the certificate change 33.

Verify

Suggested check: after the reboot, confirm that each imported certificate appears in the trust list on every node.

Rollback

Suggested rollback: delete the trust entries you imported and reboot each server again.

Step 5 Exchange metadata and create the trust at the identity provider

Microsoft AD FS (3.0, 4.0 or 5.0)

Do

Download the SP metadata from the Cisco IdS primary publisher node: use the LAN SP metadata, or the reverse-proxy cluster SP metadata when a reverse proxy fronts the IdS 45. In AD FS Management, create the relying party trust by importing that file, with the IdS FQDN as relying party identifier 7. Download the AD FS federation metadata from https:///federationmetadata/2007-06/federationmetadata.xml for upload to Cisco IdS 4.

Verify

Suggested check: confirm the new relying party trust is listed and that the federation metadata file is saved where you can reach it in Step 7.

Rollback

Suggested rollback: delete the relying party trust you created.

Microsoft Entra ID (Azure AD) enterprise application

Do

Cisco's Entra ID note was written against UCCE and Cisco IdS releases 12.0(1) through 12.6(2), so check each setting against your release 30. Download the SP metadata from the Cisco IdS primary publisher node, choosing LAN SP metadata or reverse-proxy cluster SP metadata 45. Upload it to the enterprise application, which populates the Identifier (Entity ID) and Reply URL 31. IdP metadata is later uploaded to Cisco IdS from the IdS management console or Unified CCE Administration, so save the application's metadata file for that upload 38.

Verify

Suggested check: confirm that the Identifier and Reply URL show the values from the uploaded metadata file.

Rollback

Suggested rollback: delete the enterprise application.

Another SAML 2.0 compliant identity provider

Do

The CCE 15.0(1) compatibility matrix states that Unified CCE supports all SAML 2.0 compliant identity providers and does not name specific third-party identity providers 14. Download the SP metadata from the Cisco IdS primary publisher node, choosing LAN SP metadata or reverse-proxy cluster SP metadata 45. IdP metadata is later uploaded to Cisco IdS from the IdS management console or Unified CCE Administration, so export your identity provider's metadata file for that upload 38.

Verify

Suggested check: confirm that the service provider application in your identity provider shows the entity ID and assertion consumer URL from the metadata file.

Rollback

Suggested rollback: delete the service provider application you created.

Step 6 Configure claims and signing at the identity provider

Microsoft AD FS (3.0, 4.0 or 5.0)

Do

On the relying party trust, select SHA-256 in the Secure hash algorithm field on the Advanced tab 8. Add a first claim rule from the Send LDAP Attributes as Claims template, named NameID, that maps SAM-Account-Name or UPN to the outgoing claim type uid and User-Principal-Name to user_principal 1. Add a second claim rule from the Send Claims Using a Custom Rule template, named with the FQDN of the IdS publisher, which transforms the Windows account name into a SAML name identifier 2. Enable signed SAML assertions with Set-ADFSRelyingPartyTrust -TargetName -SamlResponseSignature MessageAndAssertion 10. If you use Kerberos (Windows) authentication, disable form-based authentication in AD FS, because Kerberos does not work otherwise 3. Kerberos is supported for single-domain authentication in non-federated environments 50. For multi-domain federated AD FS, set the Claim Provider Trust's pass-through or filter incoming-claim rules to pass through all claim values 5.

Verify

Suggested check: list the relying party trust's properties and confirm the two claim rules, the hash algorithm and the response signature setting you configured. A mismatch between the secure hash algorithm on the identity provider and on Cisco IdS breaks SSO trust 35.

Rollback

Set -SamlResponseSignature back to its previous value; the parameter accepts AssertionOnly, MessageAndAssertion or MessageOnly 9. Suggested rollback: remove the claim rules you added in this step.

Microsoft Entra ID (Azure AD) enterprise application

Do

Set the Name ID from user.onpremisessamaccountname, add a uid claim from user.onpremisessamaccountname or user.givenname, and add a user_principal claim from user.userprincipalname, as Cisco's Entra ID note does 27. Set the SAML signing option to Sign SAML Response and Assertion 29. Use a signing certificate with the SHA-256 secure hash algorithm 28.

Verify

Suggested check: confirm that the claims list shows Name ID, uid and user_principal, and that the signing settings show response and assertion with SHA-256. A mismatch between the secure hash algorithm on the identity provider and on Cisco IdS breaks SSO trust 35.

Rollback

Suggested rollback: revert the claims and signing settings you changed, or delete the application.

Another SAML 2.0 compliant identity provider

Do

For reference, Cisco's AD FS procedure issues a uid claim and a user_principal claim 1, signs with MessageAndAssertion 10 and uses SHA-256 8. Cisco's Entra ID note issues uid and user_principal claims 27, signs the SAML response and assertion 29 and uses SHA-256 28. Match the hash algorithm on your identity provider to the one on Cisco IdS, because a mismatch breaks SSO trust 35.

Verify

After the identity provider metadata is uploaded, Test SSO Setup validates the trust by signing in at the identity provider 68. Suggested check: treat a passing test as the only confirmation that your attribute mapping is right.

Rollback

Suggested rollback: revert the attribute mappings and signing settings you changed in your identity provider.

Step 7 Upload identity provider metadata to Cisco IdS and test the trust

Do

Upload the identity provider metadata to Cisco IdS from either the IdS management console or Unified CCE Administration 38. Run Test SSO Setup, which validates the trust by signing in at the identity provider 68.

Verify

After the metadata upload, Cisco IdS shows SSO Status as Needs Validation until Test SSO Setup is run 68. If the test fails, check that the secure hash algorithm matches on the identity provider and on Cisco IdS 35 and that the two are time-synchronized 53.

Rollback

Suggested rollback: upload the previous identity provider metadata file. Non-SSO mode continues to use existing Active Directory-based and local authentication, so agents are unaffected while the mode is unchanged 52.

Step 8 Review Cisco IdS token and certificate settings

Do

Under Identity Service Settings > Security > Tokens, keep or change the defaults: refresh tokens 10 hours (2 to 24), authorization codes 1 minute (1 to 10) and access tokens 60 minutes (5 to 120) 69. Regenerate token-signing certificates only in a maintenance window, because it requires all agents to log out of and log back in to the Cisco Finesse desktop 56. Moving the IdS SAML certificate from SHA-1 to SHA-256 means regenerating it, re-downloading IdS metadata and updating the AD FS relying party trust, and SSO stops working until the final step completes 61.

Verify

Suggested check: reopen the token settings page and confirm it shows the values you chose.

Rollback

Set the token lifetimes back to the defaults of 10 hours, 1 minute and 60 minutes 69.

Step 9 Prepare SSO users in Unified Intelligence Center and on browsers

Do

Create an SSO-enabled Unified Intelligence Center administrator with the CLI command utils cuic user make-admin 20. Run the Unified CCE User Integration operation (Cluster Configuration > UCCE User Integration) once manually in Unified Intelligence Center to import supervisors with the required roles 70. Check that agent browsers do not reopen tabs from the previous session 15.

Verify

A supervisor in SSO mode who does not exist as a user in Unified Intelligence Center cannot log in to it, so confirm every supervisor you will enable exists there 65.

Rollback

Suggested rollback: remove the extra administrator user if you no longer need it.

Step 10 Register and test the SSO-compatible components

Do

In Unified CCE Administration > Features > Single Sign-On, click Register to register all SSO-compatible components with Cisco IdS 57. Click Test 67.

Verify

A passing test means the component reached the identity provider and Cisco IdS generated access tokens for it 67.

Rollback

Non-SSO mode continues to use existing Active Directory-based and local authentication, so registration alone does not change agent sign-in while the mode is unchanged 52.

Step 11 Set the SSO mode

Hybrid: enable agents and supervisors selectively, in waves

Do

Choose Hybrid from the Set Mode drop-down on the Unified CCE Administration Single Sign-On page 60. Hybrid mode enables agents and supervisors for single sign-on selectively, so you can phase them from non-SSO to SSO 37.

Verify

Suggested check: confirm the page shows the new mode and that an agent you have not enabled still signs in as before.

Rollback

Choose Non-SSO from the Set Mode drop-down 60, which returns to existing Active Directory-based and local authentication 52.

SSO: every agent and supervisor signs in with single sign-on

Do

SSO mode enables all agents and supervisors in the deployment for single sign-on 62, and for SSO-enabled users the Unified CCE username is the user's Active Directory or SSO account username 64. Prepare the Bulk Jobs SSO Migration file for the next step before you change the mode 16. Choose SSO from the Set Mode drop-down on the Unified CCE Administration Single Sign-On page 60.

Verify

Suggested check: confirm the page shows the new mode and that a pilot agent's desktop sign-in redirects to the identity provider. WarmTransfer's reading of the sources is that Finesse sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS and identity provider clock skew, or agents not re-signing in after an IdS upgrade 74.

Rollback

Choose Non-SSO or Hybrid from the Set Mode drop-down 60. Non-SSO mode returns to existing Active Directory-based and local authentication 52.

Step 12 Enable agents and supervisors for SSO

Hybrid: enable agents and supervisors selectively, in waves

Do

In Hybrid mode, require an individual agent to sign in with SSO by checking the Single Sign-On check box for that agent in the Unified CCE Administration Agent tool 13. For a larger wave, download the Bulk Jobs SSO Migration template, set the newUserName field, then upload it 16. Set each username to the user's Active Directory or SSO account username 64. Do not migrate an agent from non-SSO to SSO-enabled while that agent is logged in 51.

Verify

Suggested check: confirm that a migrated agent's desktop sign-in goes to the identity provider and returns to the desktop, and that an agent you have not migrated still gets the old sign-in page. WarmTransfer's reading of the sources is that Finesse sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS and identity provider clock skew, or agents not re-signing in after an IdS upgrade 74.

Rollback

Suggested rollback: clear the per-agent setting you checked, and have the agent sign in again after confirming they are logged out.

SSO: every agent and supervisor signs in with single sign-on

Do

Download the Bulk Jobs SSO Migration template, set the newUserName field, then upload it 16. Set each newUserName to the user's Active Directory or SSO account username 64. Run the job when no affected agent is logged in, because an agent must not be migrated while logged in 51.

Verify

Suggested check: confirm the bulk job completes without errors, then sign in as a test agent and as a test supervisor and confirm both reach their desktops and reports.

Rollback

Choose Non-SSO from the Set Mode drop-down 60, which returns to existing Active Directory-based and local authentication 52. Suggested rollback: keep a copy of the original usernames before the bulk job so you can restore them if needed.

Step 13 Enable SSO for Enterprise Chat and Email

Yes, ECE is used through Finesse

Do

SSO must be enabled for agents and supervisors to log in to ECE through Finesse 24. Import the IdS certificate into ECE under Security > Certificate Management with component type CISCO IDS 23. Under Security > Single Sign-On > Configurations, enable SSO with type Cisco IDS and enter the primary IdS user info endpoint URL, for example https://:8553/ids/v1/oauth/userinfo 22. Set User Identity Claim to upn when CCE agent usernames match the User Principal Name, or to sub when they match the SAM Account Name 25.

Verify

Suggested check: sign in as an SSO-enabled agent and confirm the chat and email gadget opens without a second sign-in prompt. Because Unified CCE database collation is case-sensitive, the username in the IdS user info claim must match the Unified CCE username exactly 26.

Rollback

Suggested rollback: turn off single sign-on in the agent configuration you changed in this step.

No ECE in Finesse, or ECE is out of scope for this change

Do

The SSO-capable components Cisco lists for agents and supervisors in Unified CCE 15.0(1) are the Cisco Finesse desktop, Unified Intelligence Center, Live Data and Unified CCE Administration, so no further component needs configuring here 66.

Verify

Suggested check: confirm that no agent desktop layout includes a chat or email gadget.

Step 14 Run acceptance and hand over the certificate lifecycle

Do

Tell users that a complete SSO logout requires signing out of the applications and closing the browser, and that leaving the browser open risks account misuse 18. Record the SAML certificate expiry date shown on the Identity Service Management Nodes page 43. If you use AD FS, make sure the AD FS team knows that Cisco IdS does not support AD FS Automatic Certificate Rollover, and that the trust must be re-established if the AD FS certificate rolls over 6. Cisco advises running Register and Test SSO again in CCE Administration whenever the SAML certificate changes 58.

Verify

Suggested check: confirm the operations runbook lists the certificate expiry dates and the re-test procedure.

Applicability

Applies to: Cisco Unified Contact Center Enterprise, Microsoft Active Directory Federation Services, Cisco Enterprise Chat, and Cisco Finesse. Deployments: on-premises. Sources checked 2026-10-02. The Unified CCE procedures and limits in this guide come from Release 15.0(1) documentation 66 11. Cisco's Entra ID note was written against UCCE and Cisco IdS releases 12.0(1) through 12.6(2) 30.

What remains uncertain

The detailed Cisco IdS installation procedure, whether coresident or standalone, is not covered by the sources below. Configuring the reverse proxy itself, beyond choosing the right SP metadata file, is not covered by the sources below. A vendor-published claim and signing configuration for SAML 2.0 identity providers other than AD FS and Entra ID is not covered by the sources below. Whether a user's username must be reverted when single sign-on is turned off for that user is not covered by the sources below. Whether Cisco's Entra ID settings carry over unchanged to 15.0(1) is not covered by the sources below. Which ECE releases the Enterprise Chat and Email SSO settings in Step 13 were documented for, and whether they carry over to the ECE release you run, is not covered by the sources below.

Sources

1
The first AD FS claim rule (Send LDAP Attributes as Claims, named NameID) maps SAM-Account-Name or UPN to the outgoing claim type uid and User-Principal-Name to user_principal.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (claim rule steps) · Checked 2026-10-02
2
A second AD FS claim rule, built from the Send Claims Using a Custom Rule template and named with the FQDN of the IdS publisher, transforms the Windows account name into a SAML name identifier.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (custom claim rule steps) · Checked 2026-10-02
3
Cisco IdS supports form-based and Kerberos (Windows) authentication at the IdP, and for Kerberos to work form-based authentication must be disabled in AD FS.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Authentication Types · Checked 2026-10-02
4
AD FS federation metadata for upload to Cisco IdS is downloaded from https://<ADFS Server FQDN>/federationmetadata/2007-06/federationmetadata.xml.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (download IdP metadata step) · Checked 2026-10-02
5
For multi-domain federated AD FS, the Claim Provider Trust's pass-through or filter incoming-claim rules must pass through all claim values.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Multi-Domain Configuration for Federated ADFS · Checked 2026-10-02
6
Cisco IdS does not support AD FS Automatic Certificate Rollover; if the AD FS certificate rolls over, the trust between IdS and AD FS must be re-established.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
7
In AD FS Management, the relying party trust for Cisco IdS is created by importing the IdS SP metadata file, with the IdS FQDN as relying party identifier.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (create relying party trust steps) · Checked 2026-10-02
8
On the AD FS relying party trust for Cisco IdS, SHA-256 is selected in the Secure hash algorithm field on the Advanced tab.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (relying party trust properties, Advanced tab) · Checked 2026-10-02
9
The AD FS Set-AdfsRelyingPartyTrust -SamlResponseSignature parameter accepts AssertionOnly, MessageAndAssertion or MessageOnly.
Set-AdfsRelyingPartyTrust (ADFS) · Parameters > -SamlResponseSignature · Checked 2026-10-02
10
Signed SAML assertions are enabled on the AD FS relying party trust with Set-ADFSRelyingPartyTrust -TargetName <name> -SamlResponseSignature MessageAndAssertion.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Enable Signed SAML Assertions · Checked 2026-10-02
11
The CCE 15.0(1) compatibility matrix lists AD FS 5.0 on Windows Server 2022 and 2019, AD FS 4.0 on Windows Server 2016 and AD FS 3.0 on Windows Server 2012 R2 as supported IdPs.
Contact Center Enterprise Solution Compatibility Matrix, Release 15.0(1) · Single Sign On (SSO) Identity Providers (IdPs) · Checked 2026-10-02
12
Unified CCE 15.0(1) single sign-on is not available for administrators; it covers agents and supervisors only.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
13
In Hybrid mode an individual agent is required to sign in with SSO by checking the Single Sign-On check box for that agent in the Unified CCE Administration Agent tool.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Enable users for SSO (Agent tool) · Checked 2026-10-02
14
The CCE 15.0(1) compatibility matrix states that Unified CCE supports all SAML 2.0 compliant IdPs and does not name specific third-party IdPs.
Contact Center Enterprise Solution Compatibility Matrix, Release 15.0(1) · Single Sign On (SSO) Identity Providers (IdPs) · Checked 2026-10-02
15
Cisco's migration prerequisites include checking that browsers do not reopen tabs from the previous session.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > migration prerequisites (browser configuration) · Checked 2026-10-02
16
Multiple agents and supervisors are enabled for SSO through a Bulk Jobs SSO Migration content file: download the template, set the newUserName field, then upload it.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Enable users for SSO (Bulk Jobs > SSO Migration) · Checked 2026-10-02
17
Cisco advises obtaining CA-signed application and root certificates to eliminate browser security warnings at each SSO sign-in.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > certificates section · Checked 2026-10-02
18
A complete SSO logout requires signing out of the applications and closing the browser, and users who leave the browser open risk account misuse.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations (logout) · Checked 2026-10-02
19
Cisco's SSO configuration flow is: install the CCE release, install Cisco IdS, install and configure the IdP, configure System Inventory, configure Cisco IdS, register and test SSO-compatible components, choose the SSO mode, then enable users for SSO.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Configuration Flow (task table) · Checked 2026-10-02
20
Before enabling SSO, an SSO-enabled Unified Intelligence Center administrator is created with the CLI command utils cuic user make-admin <username>.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > migration prerequisites (administrator user migration) · Checked 2026-10-02
21
Unified CCE single sign-on does not support Cisco Finesse Desktop Chat.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
22
ECE agent SSO is configured under Security > Single Sign-On > Configurations by enabling SSO with type Cisco IDS and entering the primary IdS user info endpoint URL, for example https://<ids>:8553/ids/v1/oauth/userinfo.
Configure and Troubleshoot SSO for Agents and Partition Admin in ECE · Configure > Configuring Agent Single Sign-On · Checked 2026-10-02
23
The IdS certificate is imported into ECE under Security > Certificate Management with component type CISCO IDS.
Configure and Troubleshoot SSO for Agents and Partition Admin in ECE · Configure > Creating and Importing Certificates · Checked 2026-10-02
24
ECE consoles can be used outside Finesse, but SSO must be enabled for agents and supervisors to log in to ECE through Finesse.
Configure and Troubleshoot SSO for Agents and Partition Admin in ECE · Background Information · Checked 2026-10-02
25
In ECE agent SSO, the User Identity Claim is upn when CCE agent usernames match the User Principal Name and sub when they match the SAM Account Name.
Configure and Troubleshoot SSO for Agents and Partition Admin in ECE · Configure > Configuring Agent Single Sign-On (User Identity Claim) · Checked 2026-10-02
26
Because Unified CCE database collation is case-sensitive, the username in the IdS user info claim must match the Unified CCE username exactly for ECE SSO.
Configure and Troubleshoot SSO for Agents and Partition Admin in ECE · Background Information · Checked 2026-10-02
27
Cisco's Azure (Entra ID) note sets the Name ID from user.onpremisessamaccountname, a uid claim from user.onpremisessamaccountname or user.givenname, and a user_principal claim from user.userprincipalname.
Configure UCCE Single Sign-on with Azure Cloud Integration SAML 2.0 · Configure > Azure enterprise application > User Attributes and Claims · Checked 2026-10-02
28
Cisco's Azure (Entra ID) note requires the signing certificate to use the SHA-256 secure hash algorithm.
Configure UCCE Single Sign-on with Azure Cloud Integration SAML 2.0 · Configure > SAML Signing Certificate · Checked 2026-10-02
29
Cisco's Azure (Entra ID) note sets the SAML signing option to Sign SAML Response and Assertion.
Configure UCCE Single Sign-on with Azure Cloud Integration SAML 2.0 · Configure > SAML Signing Certificate · Checked 2026-10-02
30
Cisco's Azure (Entra ID) SSO note was written against UCCE and Cisco IdS releases 12.0(1) through 12.6(2).
Configure UCCE Single Sign-on with Azure Cloud Integration SAML 2.0 · Components Used · Checked 2026-10-02
31
In the Entra ID setup, the UCCE (IdS) metadata is uploaded to the enterprise application, which populates the Identifier (Entity ID) and Reply URL.
Configure UCCE Single Sign-on with Azure Cloud Integration SAML 2.0 · Configure > Basic SAML Configuration · Checked 2026-10-02
32
The tomcat certificate of each Cisco IdS node is exported from IdS Cisco Unified OS Administration and uploaded to each Finesse node as tomcat-trust under Security > Certificate Management.
Cisco Finesse Administration Guide, Release 15.0(1) - Certificates for Cisco Identity Service · Certificates for Cisco Identity Service > export from IdS / import into Finesse · Checked 2026-10-02
33
After the IdS certificate is imported, the Cisco Finesse server is rebooted to apply the certificate change.
Cisco Finesse Administration Guide, Release 15.0(1) - Certificates for Cisco Identity Service · Certificates for Cisco Identity Service > import into Finesse (final step) · Checked 2026-10-02
34
Unified CCE single sign-on does not support Cisco Finesse IP Phone Agent (FIPPA).
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
35
A mismatch between the secure hash algorithm (SHA-1 or SHA-256) configured on the IdP and on Cisco IdS breaks SSO trust.
Troubleshoot CCE Single Sign-On with Identity Service (IdS) Certificate Management · Troubleshoot section (secure hash algorithm) · Checked 2026-10-02
36
Supporting single sign-on requires the HTTPS protocol to be enabled across the contact center enterprise solution.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
37
Hybrid mode enables agents and supervisors for single sign-on selectively, so a deployment can phase agents from non-SSO to SSO.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Modes · Checked 2026-10-02
38
IdP metadata can be uploaded to Cisco IdS from either the IdS management console or Unified CCE Administration.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (upload IdP metadata step) · Checked 2026-10-02
39
The identity provider used for Unified CCE single sign-on must support SAML 2.0.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Identity Provider · Checked 2026-10-02
40
For SSO clients at 15.0(1), Cisco IdS must also be at 15.0(1); before upgrading an SSO-enabled CCE deployment, install Reverse Proxy Installer 15.0(1) and IdS 15.0(1) first.
Contact Center Enterprise Solution Compatibility Matrix, Release 15.0(1) · Single Sign On (SSO) Identity Providers (IdPs) notes · Checked 2026-10-02
41
The Cisco IdS administration console is reached at https://<CiscoIdS server address>:8553/idsadmin.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS · Checked 2026-10-02
42
In the 2000 Agent reference design, Cisco IdS is coresident with Unified Intelligence Center and Live Data on a single VM.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Cisco Identity Service (IdS) deployment table by reference design · Checked 2026-10-02
43
The Identity Service Management Nodes page shows publisher and subscriber node status and the SAML certificate expiry date.
Troubleshoot CCE Single Sign-On with Identity Service (IdS) Certificate Management · IdS SAML certificate section (Identity Service Management > Nodes) · Checked 2026-10-02
44
A Cisco IdS cluster has a publisher node that can perform any configuration and token operation and a subscriber node whose permitted operations depend on whether the publisher is connected.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Cisco Identity Service cluster · Checked 2026-10-02
45
Two SP metadata files are downloaded from the Cisco IdS primary publisher node: LAN SP metadata, and reverse-proxy cluster SP metadata used when a reverse proxy fronts the IdS.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (download IdS metadata step) · Checked 2026-10-02
46
In the 4000, 12000 and 24000 Agent reference designs, Cisco IdS runs on a standalone VM.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Cisco Identity Service (IdS) deployment table by reference design · Checked 2026-10-02
47
The UCCE 15.0(1) install guide's coresident deployment installs Unified Intelligence Center with Live Data and IdS on publisher and subscriber nodes, then adds the coresident machine type to System Inventory and configures Live Data.
Cisco Unified Contact Center Enterprise Installation and Upgrade Guide, Release 15.0(1) - Installation · Installation Tasks > Install Coresident Deployment (Cisco Unified Intelligence Center with Live Data and IdS) (subsection headings) · Checked 2026-10-02
48
The UCCE 15.0(1) install guide's standalone IdS install comprises installing the publisher node, setting the IdS subscriber node, and installing the subscriber node.
Cisco Unified Contact Center Enterprise Installation and Upgrade Guide, Release 15.0(1) - Installation · Installation Tasks > Install Cisco Identity Service Standalone Deployment (subsection headings) · Checked 2026-10-02
49
Setting up the System Inventory for SSO includes choosing the Cisco IdS machine in a Default Identity Service field.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Set Up the System Inventory for Single Sign-On · Checked 2026-10-02
50
Kerberos is supported for single-domain authentication in non-federated environments.
Contact Center Enterprise Solution Compatibility Matrix, Release 15.0(1) · Single Sign On (SSO) Identity Providers (IdPs) · Checked 2026-10-02
51
An agent must not be migrated from non-SSO to SSO-enabled while that agent is logged in.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Enable users for SSO (SSO migration note) · Checked 2026-10-02
52
Non-SSO mode continues to use existing Active Directory-based and local authentication without single sign-on.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Modes · Checked 2026-10-02
53
Cisco IdS and the IdP must be time-synchronized for SSO to work effectively, and Cisco recommends synchronizing both to an NTP server.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations / migration prerequisites · Checked 2026-10-02
54
For a SAML 2.0 IdP other than AD FS or Entra ID, the IdP must likely be configured to send equivalent uid and user_principal claims and signed responses and assertions with SHA-256, because Cisco documents those for both of its worked IdPs and publishes no per-vendor procedure for others.inferred
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (claim rules); read with cisco-technote-220481-ucce-sso-azure and the compatibility matrix IdP section · Checked 2026-10-02
55
One Administration Workstation is set as the Principal AW, which runs periodic background tasks including SSO management, from the Unified CCE Administration Inventory page.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Set the Principal AW for Single Sign On · Checked 2026-10-02
56
Regenerating the IdS token-signing certificates requires all agents to log out of and log back in to the Cisco Finesse desktop.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Configure the Cisco Identity Service > Security > Keys and Certificates · Checked 2026-10-02
57
In Unified CCE Administration > Features > Single Sign-On, the Register button registers all SSO-compatible components with Cisco IdS.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Register Components and Set Single Sign-On Mode · Checked 2026-10-02
58
Cisco advises running Register and Test SSO again in CCE Administration whenever the SAML certificate changes.
Troubleshoot CCE Single Sign-On with Identity Service (IdS) Certificate Management · Verify section (Test SSO after SAML certificate change) · Checked 2026-10-02
59
Setting the Set Mode drop-down back to Non-SSO is the likely rollback for a failed rollout, since Non-SSO mode restores Active Directory and local authentication; Cisco does not document whether SSO usernames must also be reverted.inferred
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Modes; Register Components and Set Single Sign-On Mode · Checked 2026-10-02
60
The SSO mode (Non-SSO, Hybrid or SSO) is chosen from the Set Mode drop-down on the Unified CCE Administration Single Sign-On page.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Register Components and Set Single Sign-On Mode · Checked 2026-10-02
61
Moving the IdS SAML certificate from SHA-1 to SHA-256 means regenerating it, re-downloading IdS metadata and updating the AD FS relying party trust, and SSO stops working until the final step completes.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > SHA-256 configuration for SAML certificates · Checked 2026-10-02
62
SSO mode enables all agents and supervisors in the deployment for single sign-on.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Modes · Checked 2026-10-02
63
Unified CCE single sign-on can be implemented in one of three modes: Non-SSO, Hybrid or SSO.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Modes · Checked 2026-10-02
64
For supervisors and SSO-enabled agents, the Unified CCE username is the user's Active Directory or SSO account username.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Enable users for SSO (username) · Checked 2026-10-02
65
A supervisor in SSO mode who does not exist as a user in Unified Intelligence Center cannot log in to it.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
66
In Unified CCE 15.0(1), the SSO-capable components for agents and supervisors are the Cisco Finesse desktop, Unified Intelligence Center, Live Data and Unified CCE Administration.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Single Sign-On Support and Limitations · Checked 2026-10-02
67
The Test button on the Single Sign-On page checks that each component can reach the IdP and that Cisco IdS generates access tokens for it.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Register Components and Set Single Sign-On Mode · Checked 2026-10-02
68
After IdP metadata is uploaded, the IdS shows SSO Status as Needs Validation until the administrator runs Test SSO Setup, which validates the trust by signing in at the IdP.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Integrate Cisco IdS with AD FS (Test SSO Setup step) · Checked 2026-10-02
69
Cisco IdS token defaults are 10 hours for refresh tokens (2 to 24), 1 minute for authorization codes (1 to 10) and 60 minutes for access tokens (5 to 120).
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > Configure the Cisco Identity Service > Identity Service Settings > Security > Tokens · Checked 2026-10-02
70
Before enabling SSO, the Unified CCE User Integration operation (Cluster Configuration > UCCE User Integration) is run once manually in Unified Intelligence Center to import supervisors with the required roles.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Single Sign-On > migration prerequisites · Checked 2026-10-02
71
Because the Cisco IdS token mechanism changed in 12.6(2), agents must sign out and back in to the Finesse desktop after Cisco IdS is upgraded.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Cisco Identity Service for Single Sign-On, prerequisites note · Checked 2026-10-02
72
When SSO is enabled, the certificates of all Cisco IdS nodes must be imported into the Finesse trust store.
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Configure the Cisco Identity Service · Checked 2026-10-02
73
Updating the Finesse tomcat-trust certificate causes a temporary outage because it affects the Cisco Finesse Notification Service.
Cisco Finesse Administration Guide, Release 15.0(1) - Getting Started · Getting Started, certificate update note · Checked 2026-10-02
74
Finesse sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS/IdP clock skew, or agents not re-signing in after an IdS upgrade.inferred
Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On · Configure the Cisco Identity Service; Configuration Flow; prerequisites note (inference from) · Checked 2026-10-02

Documents

tier 2 current vendor documentation

Cite this page

APA

WarmTransfer. (2026, October 2). Setting up single sign-on for UCCE and Finesse with Cisco Identity Service. WarmTransfer. https://warmtransfer.net/guides/ucce-sso-setup

BibTeX

@misc{warmtransfer-ucce-sso-setup,
  title  = {Setting up single sign-on for UCCE and Finesse with Cisco Identity Service},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/ucce-sso-setup},
  note   = {Verified 2026-10-02}
}