Configuration · guide

Enabling OAuth refresh-token login for Jabber and Webex App in Unified CM

Cisco Unified CM

Verified 2026-10-02 · 61 sources · tier 2

For Unified CM administrators who also administer or coordinate with the owners of IM and Presence, Unity Connection and Expressway MRA for the same users..

OAuth with Refresh Login Flow is a Unified CM enterprise parameter, set in Cisco Unified CM Administration at System > Enterprise Parameters in the SSO and OAuth Configuration section, and it defaults to Disabled 37 36. When it is Enabled, clients such as Cisco Jabber can use an OAuth-based Fast Login flow that does not require the user to sign in again, for example after a network change 14.

Before you start

Cisco states that enabling OAuth with Refresh Login Flow requires support from other Unified Communications components such as Expressway and Unity Connection, running compatible versions with the refresh login flow enabled 34.
The Jabber planning guide states that OAuth refresh tokens must be turned on across all deployed components (Unified CM, IM and Presence, Unity Connection, Expressway) for the feature to work 2.
Jabber OAuth with refresh tokens requires Unified CM 11.5(SU3) or 12.0 and later, and the access-token and refresh-token expiry timers are Unified CM enterprise parameters 55.
OAuth Refresh Logins for Cisco Jabber require Jabber Release 11.9 or later 30.
With OAuth Refresh Logins, the default access-token lifespan is 60 minutes and the default refresh-token life is 60 days 12.
Each time an access token reaches 75 percent of its lifespan, the client application requests a new access token from Unified CM 46.
Unified CM access tokens are encrypted, signed and self-contained JWTs (RFC 7519), while refresh tokens are signed but not encrypted 53.
For backward compatibility, older Jabber clients and supporting applications such as Cisco Unified RTMT can still authenticate with the implicit grant flow, which is enabled by default 25.
Cisco Jabber OAuth can be set up with or without SSO, and if SSO is used, Cisco says it must be enabled for all services 35.
SAML SSO itself is configured at System > SAML Single Sign On in Cisco Unified CM Administration, and the Cisco Tomcat service must be restarted both before and after SSO is enabled 56.
Cisco warns that once OAuth Refresh Logins are enabled, disabling the feature requires resetting all Cisco Jabber clients 13.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Where will you set the access-token and refresh-token lifetimes?

On Release 15 should Webex App refresh tokens renew automatically?

How is IM and Presence deployed for these users?

Do Jabber or Webex App users get voicemail from Unity Connection?

Do clients sign in over Mobile and Remote Access through Expressway?

Five questions. One permanent page you can send to your manager.

Step 1 Inventory versions and the current key state

Do

Record the Unified CM release on every cluster, because Jabber OAuth with refresh tokens requires Unified CM 11.5(SU3) or 12.0 and later 55. Version 15 is the latest Unified CM major release listed on Cisco's support pages 57, and Version 12.5 reached end of support on 31 August 2025 58. The end of software maintenance releases for Unified CM Version 14 was 7 April 2026 59. WarmTransfer's reading of the sources is that 15SU4a is the newest build with published ReadMe and release notes, so new deployments and upgrades would normally target 15SU4a or later 60. Note whether each cluster is at 12.5(1)SU7, 14SU3 or later, because from those releases subscriber nodes as well as the publisher can update the refresh token, and the change replicates across the cluster 52. Confirm that Jabber is Release 11.9 or later 30. In standard deployments, confirm that IM and Presence runs a version matching Unified CM, because a version mismatch is not supported 61. Where clients use Mobile and Remote Access, record the Expressway version: Cisco recommends enabling OAuth with Refresh Login Flow only with an Expressway version that supports it, warning that an incompatible version may impact Jabber functionality 32.

Verify

Run show key authz signing and show key authz encryption on every Unified CM and IM and Presence node and compare the results, as Cisco TAC does to verify OAuth key consistency 49. Suggested check: record the outputs so later steps can compare against them.

Step 2 Set the token lifetimes

Keep Cisco's defaults (60 minutes / 60 days)

Do

Leave the access-token lifespan at its default of 60 minutes and the refresh-token life at its default of 60 days 12.

Verify

In System > Enterprise Parameters, OAuth Access Token Expiry Timer (minutes) shows its default of 60 1 55. Suggested check: confirm that the refresh-token timer also still shows its default value.

Set custom values in the Unified CM enterprise parameters

Do

In System > Enterprise Parameters, set OAuth Access Token Expiry Timer (minutes) to a value from 1 to 1440 1 55. Set the refresh-token expiry timer, which is also a Unified CM enterprise parameter 55. We infer that a longer refresh-token lifetime means fewer sign-in prompts but a longer window in which a lost device keeps access, so revoking a leaver's refresh token with the revoke API matters more as the lifetime grows 26. Click Save 15.

Verify

Suggested check: re-open the enterprise parameters page and confirm both timers show the values you saved.

Rollback

Set the access-token timer back to 60 minutes and the refresh-token timer back to 60 days, the defaults 12 1.

Set the refresh-token lifetime from Control Hub (Cloud-Connected UC)

Do

Confirm the prerequisites: Cloud-Connected UC activated with on-premises devices communicating with Control Hub, Unified CM clusters at 11.5 or above, and Webex App 41.12 or later 5. In Control Hub, go to Services > Calling > Client Settings > Unified CM Settings and enter a value from 1 to 1825 days in Expiration timer for OAuth refresh token 7. Schedule the change, because it takes effect immediately and previously issued refresh tokens cease to be valid, forcing client applications that hold them to re-authenticate 6.

Verify

Check each cluster for a cluster-level value, because after the expiry is first set from Control Hub it can be changed at the individual cluster level, and the cluster-level setting always takes priority 4.

Rollback

Set Expiration timer for OAuth refresh token back to its default of 60 days 7. This change also takes effect immediately and invalidates previously issued refresh tokens 6.

Step 3 Decide on refresh-token auto-renewal (Release 15)

Keep Auto Renew Refresh Token enabled (the default)

Do

Leave the Auto Renew Refresh Token enterprise parameter enabled, which is its default from Release 15 3. From Release 15, for Webex clients only, Unified CM renews the refresh token automatically when renewal is enabled on Unified CM and the Webex client and the refresh token has reached 50 percent of its lifetime 54.

Verify

Suggested check: confirm the parameter reads Enabled on the enterprise parameters page.

Disable it so refresh tokens are not auto-extended

Do

Set Auto Renew Refresh Token to Disabled, after which Unified CM does not auto-extend refresh tokens 3. Click Save 15.

Verify

Suggested check: re-open the enterprise parameters page and confirm the parameter reads Disabled.

Rollback

Set Auto Renew Refresh Token back to Enabled, its default 3.

Step 4 Enable OAuth with Refresh Login Flow on Unified CM

Do

In Cisco Unified CM Administration, go to System > Enterprise Parameters, and in the SSO and OAuth Configuration section set OAuth with Refresh Login Flow to Enabled 37. In an IM and Presence centralized deployment, set it on each telephony cluster, which automatically enables the feature in the IM and Presence central cluster 21. Click Save; Cisco's generic enterprise-parameter procedure follows Save with Reset and OK to reset all devices 15. The 12.5(1) Configure Refresh Logins procedure ends by resetting all Cisco Jabber and Webex clients after the enterprise parameters are saved 47.

Verify

Suggested check: re-open the enterprise parameters page and confirm the parameter reads Enabled. Jabber detects the change at its configuration re-fetch interval 31.

Rollback

Set OAuth with Refresh Login Flow back to Disabled, its default 37 36. Disabling the feature after it has been enabled requires resetting all Cisco Jabber clients 13, and Jabber clears cached credentials and has the user sign out and sign in again 31.

Step 5 Bring IM and Presence in line

IM and Presence nodes are in the same cluster as Unified CM

Do

The Unified CM publisher replicates the OAuth keys to all Unified CM cluster nodes, including any local IM and Presence Service nodes 43.

Verify

Run show key authz signing and show key authz encryption on the IM and Presence nodes and compare the results with the Unified CM nodes 49.

IM and Presence central cluster serving remote telephony clusters

Do

Confirm that every remote telephony cluster runs at least 11.5(1)SU4, the minimum for OAuth Refresh Logins in an IM and Presence centralized deployment 22. The setting made on the telephony clusters automatically enables the feature in the IM and Presence central cluster 21.

Verify

On the central cluster, each remote telephony cluster that supports the feature shows Synchronized for OAuth Refresh Logins, and earlier clusters may show Unsynchronized 23.

Rollback

Suggested rollback: disable the parameter on each telephony cluster as described in the Step 4 rollback.

No IM and Presence Service

Do

Run show key authz signing and show key authz encryption on every Unified CM node and compare the results 49.

Verify

Suggested check: confirm the outputs are identical on every node.

Step 6 Enable refresh login on Unity Connection

Yes from Unity Connection

Do

In Cisco Unity Connection Administration, go to System Settings > Enterprise Parameters > SSO and OAuth Configuration and set OAuth with Refresh Login Flow to Enabled, because OAuth flow is disabled by default on Unity Connection 11. Go to System Settings > Authz Server > Add New and add the Unified CM publisher of the associated phone system; with Session Management Edition, each leaf-cluster publisher can be added 9. Enter a username and password that are the same as the Unified CM system administrator credentials 8. The Ignore Certificate Errors check box is an alternative to uploading valid Unified CM certificates to the Unity Connection Tomcat trust store 10.

Verify

Suggested check: confirm the server entry saves without a certificate or credential error. Suggested check: after Step 9, confirm that a pilot user's visual voicemail works.

Rollback

Suggested rollback: delete the server entry you added. Set OAuth with Refresh Login Flow on Unity Connection back to Disabled, its default 11.

No Unity Connection integration for these clients

Do

Expressway's OAuth token with refresh option requires OAuth with refresh on Unity Connection only where Unity Connection is used 17.

Verify

Suggested check: confirm that the clients in scope are not configured with any voicemail server that would need this change.

Step 7 Authorize MRA by OAuth token with refresh

Yes for some or all users

Do

On Unified CM, tick Enable Mobile and Remote Access in the User Profile (User Management > User Settings > User Profile) used by each Jabber user, because it is mandatory for Cisco Jabber users who use OAuth Refresh Logins over MRA 33. On Expressway-C, go to Configuration > Unified Communications > Configuration > MRA Access Control and set Authorize by OAuth token with refresh to On; Cisco recommends it for all deployments that can support it, and its default is On 19. This option requires OAuth with refresh to be enabled on the Unified CM clusters and, where it is used, on Unity Connection 17. Refresh the Unified CM nodes defined on the Expressway, which fetches the keys the Expressway needs to decrypt the tokens 20. We infer that enabling the Unified CM parameter before refreshing Expressway avoids MRA clients being validated against missing keys 27. Leave Check for internal authentication availability at its default of No, because Cisco warns that Yes can allow rogue inbound requests from unauthenticated remote clients 16. The separate Authorize by OAuth token option (previously SSO mode) requires authentication through the IdP, defaults to Off, and is available only with SAML SSO authentication paths 18.

Verify

Suggested check: in Step 9, confirm that an off-network client signs in remotely and stays signed in past the access-token lifetime.

Rollback

Set Authorize by OAuth token with refresh to Off on Expressway-C 19. Suggested rollback: then reverse Step 4 if the whole change is being backed out.

No and on-premises sign-in only

Do

The Enable Mobile and Remote Access check box in the User Profile is mandatory only for Cisco Jabber users who use OAuth Refresh Logins over MRA 33.

Verify

Suggested check: confirm that the clients in scope sign in only from inside the network.

Step 8 Get clients onto the new flow

Do

Tell users to expect one sign-out and sign-in, because when OAuth is enabled or disabled on any of the servers, Jabber detects it at its configuration re-fetch interval, clears cached credentials and has the user sign out and sign in again 31. Reset all Cisco Jabber and Webex clients, as the 12.5(1) Configure Refresh Logins procedure directs 47.

Verify

Suggested check: confirm each pilot user signs in once and is not prompted again afterwards. Where SSO is used, Cisco says it must be enabled for all services 35.

Step 9 Test

Do

With a pilot user, sign in and leave the client running past the access-token lifetime, since the client requests a new access token each time the current one reaches 75 percent of its lifespan 46. Change networks and confirm no sign-in prompt appears, which is the Fast Login behaviour the enabled parameter provides 14.

Verify

A Jabber log line reading Failed to get valid access token from refresh token, maybe server issue indicates that a refresh-token exchange failed 29. If failures appear, check the Unified CM Tomcat ssosp log4j directory, where SSO application logs are in ssoApp.log and certificate operations are in certMgmt logs 51, and re-run the show key authz signing and show key authz encryption comparison 49. Suggested check: repeat the test from outside the network for users who sign in remotely.

Step 10 Put a leaver-revocation procedure in place

Do

Add a call to https://<UCMaddress>:8443/ssosp/token/revoke?user_id=<end_user>, made with administrator credentials, to the leaver process; it revokes the user's current refresh token 48.

Verify

After revocation, the user cannot obtain new access tokens 48. Suggested check: revoke a test user's token and confirm the client is prompted to sign in once its current access token expires.

Rollback

Suggested rollback: have the test user sign in again to obtain a new refresh token.

Step 11 Regenerate OAuth keys only if they are compromised

Do

Cisco TAC states the OAuth signing and encryption keys should be regenerated only if the administrator believes they have been compromised 41. Cisco recommends regenerating during off-hours, because current access and refresh tokens that use those keys become invalid 42. Regenerate the encryption key from the CLI with set key regen authz encryption, confirmed by yes, since it can be regenerated only from the CLI 40. Regenerate the signing key with set key regen authz signing, or in Cisco Unified OS Administration at Security > Certificate Management by selecting the AUTHZ certificate and clicking Regenerate 44. The publisher replicates the new keys to all Unified CM cluster nodes, including any local IM and Presence Service nodes 43. Where Expressway is used, refresh the Unified CM nodes defined on it so it fetches the keys it needs to decrypt the tokens 20. Restart the Cisco XCP Authentication Service on all IM and Presence nodes so that Jabber OAuth login works 24.

Verify

Run show key authz signing and show key authz encryption on every Unified CM and IM and Presence node and compare the results 49. Expect every user to sign in again, because existing access and refresh tokens that used the old keys are invalid 42.

Applicability

Applies to: Cisco Unified Communications Manager, Cisco Jabber, Cisco Webex Control Hub, Cisco Unity Connection, Cisco Expressway, and Cisco Unified CM IM. Deployments: on-premises and hybrid. Sources checked 2026-10-02. Auto Renew Refresh Token is a Release 15 addition 3. Subscriber-node refresh-token updates apply from Unified CM 12.5(1)SU7 and 14SU3 onwards 52. The Control Hub refresh-token timer requires Cloud-Connected UC with on-premises devices communicating with Control Hub, Unified CM clusters at 11.5 or above, and Webex App 41.12 or later 5.

What remains uncertain

The allowed range for the Unified CM refresh-token expiry timer enterprise parameter, and how it differs by release, is not covered by the sources below.
The minimum Expressway version for given Jabber and Webex App releases is not covered by the sources below.
Whether changing the Unified CM refresh-token expiry enterprise parameter invalidates already-issued refresh tokens is not covered by the sources below.
Whether a full device reset, rather than only a client reset, is required after saving this parameter is not covered by the sources below.
The exact steps to bring a centralized IM and Presence cluster and Unity Connection in line after OAuth key regeneration are not covered by the sources below.