WarmTransfer
Configuration · guide

Setting up SAML SSO for Unified CM

Cisco Unified CM

Verified 2026-09-25 · 60 sources · tier 2

For Unified CM administrators configuring SAML 2.0 single sign-on who have administrative access to Unified CM and access to their identity provider..

Cisco Collaboration SAML SSO supports SAML 2.0 service-provider-initiated SSO only 51. Cisco lists AD FS 2.0 to 5.0, Microsoft Entra ID, Okta, OpenAM, PingFederate, and F5 BIG-IP as IdPs tested with Cisco Collaboration SAML SSO 54.

Before you start

  • Ensure that NTP synchronisation is configured, with a maximum allowed time difference between the IdP and the Unified Communications applications of 3 seconds 35.
  • Ensure the browser can resolve both the service provider hostname and the IdP, including the service provider ACS URL the IdP redirects to 11.
  • Confirm that LDAP directory synchronisation is configured, as synchronising users between Unified Communications applications and the LDAP directory is mandatory for SAML SSO 28.
  • Identify a test user who is an LDAP-synchronised user with Standard CCM Super User permissions 53. Authorisation for SAML SSO administrator access is based on role-based access control configured locally on the Cisco collaboration application, not on the IdP 6.
  • Confirm the LDAP attribute used as the Unified CM user ID, because the IdP must send a claim named uid whose value maps to that attribute 56.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Which identity provider will authenticate your users?
Will you configure one SAML agreement for the whole cluster, or one per node?
Which certificate will sign the Unified CM SP metadata?
How is IM and Presence deployed alongside this cluster?
Is FIPS mode or Enhanced Security Mode enabled on the cluster?

Five questions. One permanent page you can send to your manager.

Step 1 Verify the identity provider and SSO mode support

Microsoft Entra ID + Cluster wide, one metadata file and one IdP agreement for the cluster

Do

Proceed with Microsoft Entra ID using the cluster-wide mode 13.

Verify

Suggested check: verify that a single SSO agreement is planned for the cluster.

Microsoft Entra ID + Per Node, one metadata file and IdP agreement for each node

Do

Change your configuration plan to cluster-wide mode, because with Microsoft Entra ID, Unified CM supports cluster wide agreements only and per node agreements are not supported 13.

Verify

Suggested check: verify that the configuration plan is updated to use cluster-wide mode.

Microsoft AD FS (on-premises) + Cluster wide, one metadata file and one IdP agreement for the cluster

Do

Proceed with AD FS using a single cluster-wide agreement 31.

Verify

Suggested check: verify that a single relying party trust is planned in the identity provider.

Microsoft AD FS (on-premises) + Per Node, one metadata file and IdP agreement for each node

Do

Proceed with AD FS using per-node agreements, where each node will require its own agreement at the IdP 32.

Verify

Suggested check: verify that one relying party trust per cluster node is planned in the identity provider.

Okta + Cluster wide, one metadata file and one IdP agreement for the cluster

Do

Proceed with Okta using cluster-wide mode, as SAML SSO with Okta can be enabled with the cluster-wide option only 38.

Verify

Suggested check: verify that a single SAML application is planned for the cluster.

Okta + Per Node, one metadata file and IdP agreement for each node

Do

Change your configuration plan to cluster-wide mode, because the per node option is not available for Okta 38.

Verify

Suggested check: verify that the configuration plan is updated to use cluster-wide mode.

Step 2 Prepare the service-provider certificate

The Cisco Tomcat certificate

Do

Ensure the Cisco Tomcat certificate Common Name or Subject Alternative Name matches the FQDN requested by the browser 10. Cisco strongly recommends CA-signed server certificates for SAML SSO and multiserver certificates where supported 7. In a cluster-wide agreement, pushing metadata created on one node to other nodes relies on a multi-server Tomcat certificate with a shared key pair when the Tomcat certificate is used 49.

Verify

For Jabber SSO, deploy certificates on all servers so a web browser can validate them without invalid-certificate warnings 26.

Rollback

Regenerating the Tomcat certificate regenerates SP metadata, which must then be re-uploaded to the IdP 30.

The system-generated self-signed certificate

Do

From Release 12.0, use the system-generated self-signed (ITLRecovery) certificate option for cluster-wide SSO 9. When exporting metadata, select the system-generated self-signed certificate option 8.

Verify

For Jabber SSO, deploy certificates on all servers so a web browser can validate them without invalid-certificate warnings 26.

Rollback

Switching between self-signed and Tomcat certificates regenerates SP metadata, which must then be re-uploaded to the IdP 30.

Step 3 Export the Unified CM SP metadata

Cluster wide, one metadata file and one IdP agreement for the cluster

Do

In Cisco Unified CM Administration, navigate to System > SAML Single Sign On 29. Select Cluster wide, choose the certificate option, click Export All Metadata, and save the file to a secure location 19.

Verify

Confirm that Cluster wide SSO mode produced a single metadata file representing the entire cluster 31.

Per Node, one metadata file and IdP agreement for each node

Do

In Cisco Unified CM Administration, navigate to System > SAML Single Sign On 29. Select Per Node, choose the certificate option, click Export All Metadata, and save the files to a secure location 19.

Verify

Confirm that Per Node SSO mode produced a separate metadata XML file for each cluster node 32.

Step 4 Account for IM and Presence metadata

Standard Deployment, with IM and Presence nodes inside the Unified CM cluster

Do

Maintain the exported Unified CM metadata without generating an additional file, as an IM and Presence Standard Deployment includes IM and Presence metadata in the Unified CM metadata export 24.

Verify

Suggested check: verify that the exported metadata XML includes the IM and Presence node entries.

Centralized Deployment, with a standalone IM and Presence cluster

Do

In an IM and Presence Centralized Deployment, export metadata and repeat the SSO configuration steps separately on the standalone IM and Presence publisher node 23.

Verify

Suggested check: verify that separate metadata has been exported from the standalone IM and Presence publisher node.

No IM and Presence Service

Do

Cluster wide SSO mode produces a single metadata file that represents the entire cluster 31.

Verify

Suggested check: verify that only Unified CM nodes are present in the exported SP metadata.

Step 5 Configure the IdP and download its metadata

Microsoft Entra ID

Do

Add the Cisco Unified Communications Manager gallery application in Microsoft Entra ID, select SAML, and upload the Unified CM SP metadata file to populate the Identifier (Entity ID) and Reply URL 16. Set the enterprise application property "Enabled for users to sign in?" to Yes 15. Map the uid claim to the source attribute user.onpremisessamaccountname 18. If the Unified CM user ID is not the default sAMAccountName, change the uid claim source to the matching Entra ID attribute 17. Download the Federation Metadata XML from the SAML Signing Certificate section 14.

Verify

Ensure the IdP sends the claim named uid mapped to the Unified CM user ID 56, and that the IdP NameID format is urn:oasis:names:tc:SAML:2.0:nameid-format:transient 34.

Microsoft AD FS (on-premises) + Cluster wide, one metadata file and one IdP agreement for the cluster

Do

In AD FS, use the Add Relying Party Trust wizard to import the Unified CM SP metadata file, border-served at https://<CUCM_FQDN>:8443/ssosp/ws/config/metadata/sp 4. Create a claim rule using the Send LDAP Attributes as Claims template, mapping the LDAP directory-sync attribute (for example SAM-Account-Name) to an outgoing claim type typed manually as lowercase uid 5. Add a second, custom claim rule that issues a transient NameID with namequalifier set to the AD FS identity and spnamequalifier set to the Unified CM entity ID 2. Download the AD FS IdP metadata from https://<ADFS_FQDN>/FederationMetadata/2007-06/FederationMetadata.xml 1.

Verify

Confirm that multiple certificates are not present in the signing and encryption portion of the assertion, as multiple certificates are not supported 50. Ensure the IdP NameID format is urn:oasis:names:tc:SAML:2.0:nameid-format:transient 34.

Microsoft AD FS (on-premises) + Per Node, one metadata file and IdP agreement for each node

Do

In AD FS, use the Add Relying Party Trust wizard to import each node's Unified CM SP metadata file, also served at https://<CUCM_FQDN>:8443/ssosp/ws/config/metadata/sp 4. For each relying party trust, add a rule using the Send LDAP Attributes as Claims template mapping the LDAP directory-sync attribute to outgoing lowercase uid 5. For each trust, add a second custom rule that issues a transient NameID with namequalifier set to the AD FS identity and spnamequalifier set to the node's Unified CM entity ID 2. Download the AD FS IdP metadata from https://<ADFS_FQDN>/FederationMetadata/2007-06/FederationMetadata.xml 1.

Verify

Confirm that multiple certificates are not present in the signing and encryption portion of the assertion, as multiple certificates are not supported 50. Ensure the IdP NameID format is urn:oasis:names:tc:SAML:2.0:nameid-format:transient 34.

Okta + Cluster wide, one metadata file and one IdP agreement for the cluster

Do

In the Okta SAML 2.0 web app, configure the Single Sign On URL to the SP metadata AssertionConsumerService at index 0 and configure the Audience URI to the SP metadata entityID 37. For multi-node clusters, enable "Allow this app to request other SSO URLs" and add each node's HTTP-POST ACS URL as a requestable SSO URL 40. Ensure the uid claim is mapped to the attribute matching the Unified CM user ID 56. Download the IdP metadata from the Okta Sign On tab and edit its NameIDFormat lines to the transient format before importing into Unified CM 39.

Verify

Ensure the IdP NameID format is urn:oasis:names:tc:SAML:2.0:nameid-format:transient 34.

Okta + Per Node, one metadata file and IdP agreement for each node

Do

Do not configure per-node agreements in Okta, as the per node option is not available for Okta 38. Enable SAML SSO with Okta with the cluster-wide option only 38.

Verify

Suggested check: verify that per-node configuration on the identity provider is halted.

Step 6 Restart Cisco Tomcat

Do

Restart the Cisco Tomcat service before enabling SAML SSO by running utils service restart Cisco Tomcat on all Unified CM and IM and Presence cluster nodes where SSO runs 47 55.

Verify

Suggested check: verify that the service is active on each node and that the administrative interface is accessible.

Step 7 Run the Enable SAML SSO wizard and test

Cluster wide, one metadata file and one IdP agreement for the cluster

Do

In Cisco Unified CM Administration, navigate to System > SAML Single Sign On, click Enable SAML SSO, click Continue, and run the Test for Multi-server tomcat certificates step 12 33. Click Next, browse to the IdP metadata file, click Import IdP Metadata, and click Next 12. Select the test user, click Run SSO Test, sign in at the IdP prompt, and then click Finish 12.

Verify

Confirm that the wizard reports "SSO Test Succeeded!" 52. Run utils sso status on the CLI to confirm current SSO configuration, metadata import, and SSO test status 60.

Rollback

Run utils sso disable on the CLI to disable SAML SSO and return sign-in to local authentication 59. After disabling, restart Cisco Tomcat with utils service restart Cisco Tomcat on all Unified CM and IM and Presence cluster nodes where SSO runs 55.

Per Node, one metadata file and IdP agreement for each node

Do

In Cisco Unified CM Administration on each node, navigate to System > SAML Single Sign On, click Enable SAML SSO, click Continue, click Next, browse to the IdP metadata file, click Import IdP Metadata, and click Next 12. Select the test user, click Run SSO Test, sign in, and click Finish 12. Repeat the enable process on each Unified CM node 41.

Verify

Confirm that the wizard on each node reports "SSO Test Succeeded!" 52. Run utils sso status on each node's CLI to confirm metadata import and test status 60.

Rollback

Run utils sso disable on the CLI to return sign-in to local authentication 59. After disabling, restart Cisco Tomcat with utils service restart Cisco Tomcat on all Unified CM and IM and Presence cluster nodes where SSO runs 55.

Step 8 Apply security mode signing requirements and restart Tomcat

Yes, FIPS or ESM is on

Do

On the admin CLI of all Unified CM nodes, set the SSO signing algorithm to SHA256 using utils sso set signing-algorithm sha256 20. Restart Cisco Tomcat with utils service restart Cisco Tomcat on all Unified CM and IM and Presence cluster nodes where SSO runs 55.

Verify

Suggested check: verify that an administrative user can sign in via single sign-on after the service restarts.

Rollback

Run utils sso disable from the CLI to return to local authentication 59.

No

Do

Restart Cisco Tomcat with utils service restart Cisco Tomcat on all Unified CM and IM and Presence cluster nodes where SSO runs 55.

Verify

Suggested check: verify that an administrative user can sign in via single sign-on after the service restarts.

Rollback

Run utils sso disable from the CLI to return to local authentication 59.

Step 9 Validate the recovery URL and platform administrators

Do

Access the SAML SSO recovery URL at https://<hostname>:8443/ssosp/local/login, which bypasses SSO for troubleshooting and administrative tasks such as updating metadata 45. Sign in with an application user that has administrative privileges, as only application users with administrative privileges can use the recovery URL 43. Note that the recovery URL is enabled or disabled from the CLI with utils sso recovery-url enable and utils sso recovery-url disable 44. For Cisco Unified OS Administration and Disaster Recovery System, provision platform administrators on each node individually, because each platform administrator is specific to a node and is not replicated across the cluster 42.

Verify

Confirm that administrative access is granted through https://<hostname>:8443/ssosp/local/login without redirecting to the IdP 45. Note that the recovery URL does not work for end users, LDAP or local, signing in to the Self Care portal 46.

Rollback

Run utils sso recovery-url disable on the CLI to disable the recovery URL if policy forbids an SSO bypass 44.

Step 10 Configure client and token settings

Do

Ensure Cisco Jabber can reach service discovery influenced by the ServicesDomain, VoiceServicesDomain, and ServiceDiscoveryExcludedServices parameters, which Jabber uses to enable SAML SSO in the client 27. Leave SSO Login Behavior for Cisco Jabber on iOS set to Use Embedded Browser, as Cisco does not recommend Use Native Browser except in a controlled MDM deployment 25. If Jabber OAuth with refresh tokens is used, note that it requires Unified CM 11.5(SU3) or 12.0 and later, and configure the access and refresh token expiry timers in the Unified CM enterprise parameters 36.

Verify

Suggested check: verify that a client performs service discovery and redirects to the IdP for authentication.

Step 11 Execute maintenance updates and troubleshooting

Do

When IdP metadata changes, sign in through the recovery URL, choose System > SAML Single Sign On, click Update IdP Metadata File, import the new file, run the SSO test with a Standard CCM Super User, and click Finish 57. Note that updating IdP metadata in cluster-wide mode restarts the Cisco Tomcat, Cisco SSOSP Tomcat, and Cisco UDS Tomcat services on all cluster nodes 58. After a server domain or hostname change, export new metadata via the recovery URL, upload it to the IdP, and run the SSO test, as SAML SSO does not work until these steps are completed 21. SP metadata must also be re-uploaded to the IdP after switching between self-signed and Tomcat certificates, regenerating the Tomcat certificate, or changing cluster configuration 30. If sign-in fails, raise SSO logging to debug on each node by running set samltrace level debug 48.

Verify

After updating IdP metadata, confirm that the SSO test succeeds 57. Use utils sso status to inspect configuration status 60.

Rollback

Run utils sso disable from the CLI to disable SAML SSO and revert to local authentication 59.

Applicability

Applies to: Cisco Unified Communications Manager, Microsoft Entra ID, Cisco Unified Communications Manager IM, and Cisco Jabber. Deployments: on-premises and multi-tenant. Sources checked 2026-09-25. Jabber OAuth with refresh tokens requires Unified CM 11.5(SU3) or 12.0 and later 36. From Release 12.0, cluster-wide SSO requires either a multi-server Tomcat certificate or the system-generated self-signed (ITLRecovery) certificate option 9.

What remains uncertain

Whether the IdP signing algorithm must match Unified CM when FIPS mode or Enhanced Security Mode is disabled is not covered by the sources below. Whether utils sso disable acts cluster-wide or requires per-node execution on Release 15 is not covered by the sources below. The specific actions taken by the enable wizard when the Test for Multi-server tomcat certificates fails are not covered by the sources below.

See also

Configures

  • Cisco unified cmstub — Target system; no Unified CM topic exists in the corpus yet

Related to

Sources

  1. 1
    AD FS IdP metadata is downloaded from https://<ADFS_FQDN>/FederationMetadata/2007-06/FederationMetadata.xml.
    Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0 · Configure > IdP metadata export · Checked 2026-09-25
  2. 2
    AD FS needs a second, custom claim rule that issues a transient NameID with namequalifier set to the AD FS identity and spnamequalifier set to the Unified CM entity ID.
    Configure Single SAML IdP Connection/Agreement per Cluster with AD FS Version 2.0 · Configure > AD FS claim rules > custom NameID rule · Checked 2026-09-25
  3. 3
    Of the three IdPs covered here, only AD FS has no Cisco statement restricting Unified CM to cluster-wide agreements, so AD FS is the IdP on which per node mode remains an option.inferred
    Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0 · Per-node versus cluster-wide discussion (technote recommends Cluster Wide) · Checked 2026-09-25
  4. 4
    Cisco's AD FS 3.0 example imports Unified CM SP metadata, also served at https://<CUCM_FQDN>:8443/ssosp/ws/config/metadata/sp, with the Add Relying Party Trust wizard.
    Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0 · Configure > Add Relying Party Trust · Checked 2026-09-25
  5. 5
    In AD FS the first claim rule uses the Send LDAP Attributes as Claims template, mapping the LDAP attribute used for Unified CM directory sync (for example SAM-Account-Name) to an outgoing claim type typed manually as lowercase uid.
    Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0 · Configure > Claim rules > Rule 1 · Checked 2026-09-25
  6. 6
    Authorisation for SAML SSO administrator access is based on role-based access control configured locally on the Cisco collaboration application, not on the IdP.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution · SAML-Based SSO Solution > authorisation note · Checked 2026-09-25
  7. 8
    When exporting metadata the administrator chooses either a system-generated self-signed certificate or the Cisco Tomcat certificate.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Initiate SSO Configuration on Collaboration Applications > Certificate · Checked 2026-09-25
  8. 9
    Cluster-wide SSO requires either a multi-server Tomcat certificate or, from Release 12.0, the system-generated self-signed (ITLRecovery) certificate option.
    Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM) · Background information > cluster-wide SSO · Checked 2026-09-25
  9. 10
    The certificate Common Name or Subject Alternative Name must match the FQDN the browser requests.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Prerequisites > Certificate Management · Checked 2026-09-25
  10. 11
    The browser must be able to resolve both the service provider hostname and the IdP, including the service provider ACS URL the IdP redirects to.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Prerequisites > DNS Setup · Checked 2026-09-25
  11. 12
    The enable procedure is: System > SAML Single Sign On, Enable SAML SSO, Continue, Next, browse to the IdP metadata file, Import IdP Metadata, Next, select a test user, Run SSO Test, sign in, then Finish.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Enable SAML SSO for Cisco Collaboration Applications > procedure · Checked 2026-09-25
  12. 13
    With Microsoft Entra ID, Unified CM, IM and Presence, Unity Connection and Expressway support cluster wide agreements only; per node agreements are not supported.
    SAML SSO Microsoft Entra ID Identity Provider · Overview / supported agreements note · Checked 2026-09-25
  13. 14
    The Entra ID IdP metadata for Unified CM is the Federation Metadata XML downloaded from the SAML Signing Certificate section.
    Configure Cisco Unified Communications Manager for Single sign-on with Microsoft Entra ID · Configure Microsoft Entra SSO > step 8 · Checked 2026-09-25
  14. 15
    Cisco's Entra ID guide requires the enterprise application property 'Enabled for users to sign in?' to be Yes.
    SAML SSO Microsoft Entra ID Identity Provider · Configure SAML SSO on Microsoft Entra ID > Properties · Checked 2026-09-25
  15. 17
    Cisco's Entra ID guide says that if the Unified CM user ID is not the default sAMAccountName, the uid claim source must be changed to the matching Entra ID attribute.
    SAML SSO Microsoft Entra ID Identity Provider · Configure SAML SSO on Microsoft Entra ID > Attributes & Claims · Checked 2026-09-25
  16. 18
    Microsoft's tutorial maps the uid claim to the source attribute user.onpremisessamaccountname.
    Configure Cisco Unified Communications Manager for Single sign-on with Microsoft Entra ID · Configure Microsoft Entra SSO > step 7 attribute table · Checked 2026-09-25
  17. 19
    After selecting SSO mode and certificate, the administrator clicks Export All Metadata and saves the file to a secure location.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Initiate SSO Configuration on Collaboration Applications > procedure steps 1-4 · Checked 2026-09-25
  18. 20
    If FIPS or Enhanced Security Mode is enabled, set the SSO signing algorithm to SHA256 with 'utils sso set signing-algorithm sha256' on the admin CLI of all Unified CM nodes.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Enable SAML SSO for Cisco Collaboration Applications > FIPS/ESM note · Checked 2026-09-25
  19. 21
    After a server domain or hostname change SAML SSO does not work until new metadata is exported via the recovery URL, uploaded to the IdP and the SSO test is run.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Additional Configuration Tasks > domain or hostname change · Checked 2026-09-25
  20. 22
    Because Unified CM SSO is SP-initiated only, IdP-side objects created before Enable SAML SSO completes are not used by Unified CM, so removing them before that point does not affect Unified CM sign-in.inferred
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers · SAML SSO Requirements for Identity Providers (SP-initiated only) · Checked 2026-09-25
  21. 23
    With an IM and Presence Centralized Deployment, metadata is exported and the SSO configuration steps are repeated separately on the standalone IM and Presence publisher node.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · SSO Configuration for IM and Presence Service > Centralized Deployment · Checked 2026-09-25
  22. 24
    With an IM and Presence Standard Deployment, IM and Presence metadata is included in the Unified CM metadata export.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Initiate SSO Configuration on Collaboration Applications > note; SSO Configuration for IM and Presence Service · Checked 2026-09-25
  23. 25
    The SSO Login Behavior for iOS enterprise parameter defaults to Use Embedded Browser, and Cisco does not recommend Use Native Browser except in a controlled MDM deployment.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Configure SSO Login Behavior for Cisco Jabber on iOS (System > Enterprise Parameters) · Checked 2026-09-25
  24. 26
    For Jabber SSO, certificates must be deployed on all servers so a web browser can validate them, otherwise users see invalid-certificate warnings.
    On-Premises Deployment for Cisco Jabber 12.6 - Users · Enable SAML SSO in the Client > step 1 · Checked 2026-09-25
  25. 27
    Cisco Jabber uses standard service discovery to enable SAML SSO in the client, influenced by the ServicesDomain, VoiceServicesDomain and ServiceDiscoveryExcludedServices parameters.
    On-Premises Deployment for Cisco Jabber 12.6 - Users · Enable SAML SSO in the Client > step 2 · Checked 2026-09-25
  26. 28
    LDAP directory synchronisation is mandatory for SAML SSO: users must be synchronised between the Unified Communications applications and the LDAP directory.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Prerequisites > Directory Setup · Checked 2026-09-25
  27. 29
    SAML SSO is configured in Cisco Unified CM Administration under System > SAML Single Sign On.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · SAML SSO Configuration Task Flow > Initiate SSO Configuration on Collaboration Applications · Checked 2026-09-25
  28. 30
    Switching between self-signed and Tomcat certificates, regenerating the Tomcat certificate, or changing cluster configuration regenerates SP metadata, which must be re-uploaded to the IdP.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Feature Interactions and Restrictions · Checked 2026-09-25
  29. 31
    Cluster wide SSO mode produces a single metadata file that represents the entire cluster.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Initiate SSO Configuration on Collaboration Applications > SSO Mode · Checked 2026-09-25
  30. 32
    Per Node SSO mode produces a separate metadata XML file for each cluster node, each needing its own agreement at the IdP.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Initiate SSO Configuration on Collaboration Applications > SSO Mode · Checked 2026-09-25
  31. 33
    For cluster wide agreements only, the enable wizard includes a Test for Multi-server tomcat certificates step.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Enable SAML SSO for Cisco Collaboration Applications > procedure step 4 · Checked 2026-09-25
  32. 34
    The IdP NameID format must be urn:oasis:names:tc:SAML:2.0:nameid-format:transient.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers · SAML SSO Requirements for Identity Providers · Checked 2026-09-25
  33. 35
    SAML SSO for Unified CM requires NTP synchronisation, and the maximum allowed time difference between the IdP and the Unified Communications applications is 3 seconds.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Prerequisites > NTP Setup · Checked 2026-09-25
  34. 36
    Jabber OAuth with refresh tokens requires Unified CM 11.5(SU3) or 12.0 and later, and the access and refresh token expiry timers are Unified CM enterprise parameters.
    Planning Guide for Cisco Jabber 14.0 - User Management · User Management > OAuth · Checked 2026-09-25
  35. 37
    In the Okta SAML 2.0 web app, the Single Sign On URL is the SP metadata AssertionConsumerService at index 0 and the Audience URI is the SP metadata entityID.
    SAML SSO Okta Identity Provider · Configure Okta > Create new app > SAML settings · Checked 2026-09-25
  36. 38
    SAML SSO with Okta can be enabled with the cluster-wide option only; the per node option is not available for Okta.
    SAML SSO Okta Identity Provider · Okta guide > restriction note · Checked 2026-09-25
  37. 39
    Cisco's Okta guide downloads the IdP metadata from the Okta Sign On tab and edits its NameIDFormat lines to the transient format before importing into Unified CM.
    SAML SSO Okta Identity Provider · Configure Okta > download IdP metadata · Checked 2026-09-25
  38. 40
    For multi-node clusters Cisco's Okta guide enables 'Allow this app to request other SSO URLs' and adds each node's HTTP-POST ACS URL as a requestable SSO URL.
    SAML SSO Okta Identity Provider · Configure Okta > Advanced settings > Requestable SSO URLs · Checked 2026-09-25
  39. 41
    With per node agreements, the enable process is repeated on each Unified CM node.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Enable SAML SSO for Cisco Collaboration Applications > per node note · Checked 2026-09-25
  40. 42
    For Cisco Unified OS Administration and Disaster Recovery System, each platform administrator is specific to a node and is not replicated across the cluster.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution · SAML SSO for platform applications note · Checked 2026-09-25
  41. 43
    Only application users with administrative privileges can use the recovery URL.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Recovery URL · Checked 2026-09-25
  42. 44
    The recovery URL is enabled or disabled from the CLI with 'utils sso recovery-url enable' and 'utils sso recovery-url disable'.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Recovery URL · Checked 2026-09-25
  43. 45
    The SAML SSO recovery URL is https://<hostname>:8443/ssosp/local/login and bypasses SSO for troubleshooting and administrative tasks such as updating metadata.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Recovery URL · Checked 2026-09-25
  44. 46
    The recovery URL does not work for end users, LDAP or local, signing in to the Self Care portal.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Recovery URL · Checked 2026-09-25
  45. 47
    Cisco instructs restarting the Cisco Tomcat service before enabling SAML SSO.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Enable SAML SSO for Cisco Collaboration Applications > Before you begin · Checked 2026-09-25
  46. 48
    'set samltrace level debug' raises SSO logging to debug and must be run on each node.
    Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM) · Troubleshoot > set log level · Checked 2026-09-25
  47. 49
    In a cluster-wide (single) agreement one node creates the SP metadata and pushes it to the other nodes, which relies on a multi-server Tomcat certificate with a shared key pair when the Tomcat certificate is used.
    Configure Single SAML IdP Connection/Agreement per Cluster with AD FS Version 2.0 · Background Information · Checked 2026-09-25
  48. 50
    Multiple certificates in the signing and encryption portion of the SAML assertion are not supported.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers · SAML SSO Requirements for Identity Providers · Checked 2026-09-25
  49. 51
    Cisco Collaboration SAML SSO supports SAML 2.0 service-provider-initiated SSO only.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers · SAML SSO Requirements for Identity Providers · Checked 2026-09-25
  50. 52
    A successful SSO test in the Unified CM wizard reports 'SSO Test Succeeded!'.
    Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0 · Verify · Checked 2026-09-25
  51. 53
    The SSO test user must be an LDAP-synchronised user with Standard CCM Super User permissions.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Enable SAML SSO for Cisco Collaboration Applications > procedure step 9; Update IdP Metadata · Checked 2026-09-25
  52. 54
    Cisco lists AD FS 2.0 to 5.0, Microsoft Entra ID, Okta, OpenAM, PingFederate and F5 BIG-IP as IdPs tested with Cisco Collaboration SAML SSO.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution · Identity Provider (IdP) list of tested IdPs · Checked 2026-09-25
  53. 55
    Before and after enabling or disabling SAML SSO, restart Cisco Tomcat with 'utils service restart Cisco Tomcat' on all Unified CM and IM and Presence cluster nodes where SSO runs.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Restart Cisco Tomcat Service · Checked 2026-09-25
  54. 56
    The IdP must send a claim named uid whose value maps to the LDAP attribute used as the Unified CM user ID, for example sAMAccountName.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers · SAML SSO Requirements for Identity Providers · Checked 2026-09-25
  55. 57
    When IdP metadata changes, sign in through the recovery URL, choose System > SAML Single Sign On, click Update IdP Metadata File, import the new file, run the SSO test with a Standard CCM Super User and click Finish.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Update IdP Metadata · Checked 2026-09-25
  56. 58
    Updating IdP metadata in cluster-wide mode restarts the Cisco Tomcat, Cisco SSOSP Tomcat and Cisco UDS Tomcat services on all cluster nodes.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Update IdP Metadata > note · Checked 2026-09-25
  57. 59
    'utils sso disable' disables SAML SSO from the CLI and returns sign-in to local authentication.
    Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM) · Troubleshoot > CLI commands · Checked 2026-09-25
  58. 60
    'utils sso status' shows the current SSO configuration including metadata import and SSO test status.
    Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM) · Troubleshoot > CLI commands · Checked 2026-09-25

Documents

tier 2 current vendor documentation

Configure and Troubleshoot SSO on Cisco Unified Communications Manager (CUCM)

Cisco · 2021-08-05 · accessed 2026-09-25

tier 2 current vendor documentation

Configure Cisco Unified Communications Manager for Single sign-on with Microsoft Entra ID

Microsoft · 2026-06-15 · accessed 2026-09-25

tier 2 current vendor documentation

Configure SAML SSO on Cisco Unified Communications Manager with ADFS 3.0

Cisco · 2021-03-24 · accessed 2026-09-25

tier 2 current vendor documentation

Configure Single SAML IdP Connection/Agreement per Cluster with AD FS Version 2.0

Cisco · 2016-06-29 · accessed 2026-09-25

tier 2 current vendor documentation

On-Premises Deployment for Cisco Jabber 12.6 - Users

Cisco · 2024-04-01 · accessed 2026-09-25

tier 2 current vendor documentation

Planning Guide for Cisco Jabber 14.0 - User Management

Cisco · accessed 2026-09-25

tier 2 current vendor documentation

SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration

Cisco · 2025-05-26 · accessed 2026-09-25

tier 2 current vendor documentation

SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Requirements for Identity Providers

Cisco · accessed 2026-09-25

tier 2 current vendor documentation

SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML-Based SSO Solution

Cisco · 2025-05-26 · accessed 2026-09-25

tier 2 current vendor documentation

SAML SSO Microsoft Entra ID Identity Provider

Cisco · 2024-11-05 · accessed 2026-09-25

tier 2 current vendor documentation

SAML SSO Okta Identity Provider

Cisco · 2017-08-31 · accessed 2026-09-25

Cite this page

APA

WarmTransfer. (2026, September 25). Setting up SAML SSO for Unified CM. WarmTransfer. https://warmtransfer.net/guides/cucm-saml-sso-setup

BibTeX

@misc{warmtransfer-cucm-saml-sso-setup,
  title  = {Setting up SAML SSO for Unified CM},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/cucm-saml-sso-setup},
  note   = {Verified 2026-09-25}
}