Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On

Publisher

Cisco Systems

URL

https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cust_contact/contact_center/icm_enterprise/icm_enterprise_15_0_1/ucce_b_1501_features-guide/rcct_m_1501_single-sign-on.html

Published

2026-07-31

Updated

unknown

Accessed

2026-10-02

HTTP status

200

License

Cisco documentation; all rights reserved; no-redistribution; short excerpts and locators only

Source notes citing this source

• Finesse sign-in failures right after an SSO cutover are most likely explained by missing IdS certificates in the Finesse trust store, IdS/IdP clock skew, or agents not re-signing in after an IdS upgrade. inferred in context
• In hybrid mode, agents are enabled individually for SSO in the Unified CCE Administration Agent tool. in context
• When SSO is enabled, the certificates of all Cisco IdS nodes must be imported into the Finesse trust store. in context
• Cisco IdS and the IdP must be time-synchronised, preferably via NTP, for SSO to work. in context
• Because the Cisco IdS token mechanism changed in 12.6(2), agents must sign out and back in to the Finesse desktop after Cisco IdS is upgraded. in context
• Unified CCE supports three authentication modes for Finesse users: SSO for all agents, hybrid with agents enabled selectively, and non-SSO. in context
• The first AD FS claim rule (Send LDAP Attributes as Claims, named NameID) maps SAM-Account-Name or UPN to the outgoing claim type uid and User-Principal-Name to user_principal. in context
• A second AD FS claim rule, built from the Send Claims Using a Custom Rule template and named with the FQDN of the IdS publisher, transforms the Windows account name into a SAML name identifier. in context
• Cisco IdS supports form-based and Kerberos (Windows) authentication at the IdP, and for Kerberos to work form-based authentication must be disabled in AD FS. in context
• AD FS federation metadata for upload to Cisco IdS is downloaded from https://<ADFS Server FQDN>/federationmetadata/2007-06/federationmetadata.xml. in context
• For multi-domain federated AD FS, the Claim Provider Trust's pass-through or filter incoming-claim rules must pass through all claim values. in context
• Cisco IdS does not support AD FS Automatic Certificate Rollover; if the AD FS certificate rolls over, the trust between IdS and AD FS must be re-established. in context
• In AD FS Management, the relying party trust for Cisco IdS is created by importing the IdS SP metadata file, with the IdS FQDN as relying party identifier. in context
• On the AD FS relying party trust for Cisco IdS, SHA-256 is selected in the Secure hash algorithm field on the Advanced tab. in context
• Signed SAML assertions are enabled on the AD FS relying party trust with Set-ADFSRelyingPartyTrust -TargetName <name> -SamlResponseSignature MessageAndAssertion. in context
• Unified CCE 15.0(1) single sign-on is not available for administrators; it covers agents and supervisors only. in context
• In Hybrid mode an individual agent is required to sign in with SSO by checking the Single Sign-On check box for that agent in the Unified CCE Administration Agent tool. in context
• Cisco's migration prerequisites include checking that browsers do not reopen tabs from the previous session. in context
• Multiple agents and supervisors are enabled for SSO through a Bulk Jobs SSO Migration content file: download the template, set the newUserName field, then upload it. in context
• Cisco advises obtaining CA-signed application and root certificates to eliminate browser security warnings at each SSO sign-in. in context
• A complete SSO logout requires signing out of the applications and closing the browser, and users who leave the browser open risk account misuse. in context
• Cisco's SSO configuration flow is: install the CCE release, install Cisco IdS, install and configure the IdP, configure System Inventory, configure Cisco IdS, register and test SSO-compatible components, choose the SSO mode, then enable users for SSO. in context
• Before enabling SSO, an SSO-enabled Unified Intelligence Center administrator is created with the CLI command utils cuic user make-admin <username>. in context
• Unified CCE single sign-on does not support Cisco Finesse Desktop Chat. in context
• Unified CCE single sign-on does not support Cisco Finesse IP Phone Agent (FIPPA). in context
• Supporting single sign-on requires the HTTPS protocol to be enabled across the contact center enterprise solution. in context
• Hybrid mode enables agents and supervisors for single sign-on selectively, so a deployment can phase agents from non-SSO to SSO. in context
• IdP metadata can be uploaded to Cisco IdS from either the IdS management console or Unified CCE Administration. in context
• The identity provider used for Unified CCE single sign-on must support SAML 2.0. in context
• The Cisco IdS administration console is reached at https://<CiscoIdS server address>:8553/idsadmin. in context
• In the 2000 Agent reference design, Cisco IdS is coresident with Unified Intelligence Center and Live Data on a single VM. in context
• A Cisco IdS cluster has a publisher node that can perform any configuration and token operation and a subscriber node whose permitted operations depend on whether the publisher is connected. in context
• Two SP metadata files are downloaded from the Cisco IdS primary publisher node: LAN SP metadata, and reverse-proxy cluster SP metadata used when a reverse proxy fronts the IdS. in context
• In the 4000, 12000 and 24000 Agent reference designs, Cisco IdS runs on a standalone VM. in context
• Setting up the System Inventory for SSO includes choosing the Cisco IdS machine in a Default Identity Service field. in context
• An agent must not be migrated from non-SSO to SSO-enabled while that agent is logged in. in context
• Non-SSO mode continues to use existing Active Directory-based and local authentication without single sign-on. in context
• Cisco IdS and the IdP must be time-synchronized for SSO to work effectively, and Cisco recommends synchronizing both to an NTP server. in context
• For a SAML 2.0 IdP other than AD FS or Entra ID, the IdP must likely be configured to send equivalent uid and user_principal claims and signed responses and assertions with SHA-256, because Cisco documents those for both of its worked IdPs and publishes no per-vendor procedure for others. inferred in context
• One Administration Workstation is set as the Principal AW, which runs periodic background tasks including SSO management, from the Unified CCE Administration Inventory page. in context
• Regenerating the IdS token-signing certificates requires all agents to log out of and log back in to the Cisco Finesse desktop. in context
• In Unified CCE Administration > Features > Single Sign-On, the Register button registers all SSO-compatible components with Cisco IdS. in context
• Setting the Set Mode drop-down back to Non-SSO is the likely rollback for a failed rollout, since Non-SSO mode restores Active Directory and local authentication; Cisco does not document whether SSO usernames must also be reverted. inferred in context
• The SSO mode (Non-SSO, Hybrid or SSO) is chosen from the Set Mode drop-down on the Unified CCE Administration Single Sign-On page. in context
• Moving the IdS SAML certificate from SHA-1 to SHA-256 means regenerating it, re-downloading IdS metadata and updating the AD FS relying party trust, and SSO stops working until the final step completes. in context
• SSO mode enables all agents and supervisors in the deployment for single sign-on. in context
• Unified CCE single sign-on can be implemented in one of three modes: Non-SSO, Hybrid or SSO. in context
• For supervisors and SSO-enabled agents, the Unified CCE username is the user's Active Directory or SSO account username. in context
• A supervisor in SSO mode who does not exist as a user in Unified Intelligence Center cannot log in to it. in context
• In Unified CCE 15.0(1), the SSO-capable components for agents and supervisors are the Cisco Finesse desktop, Unified Intelligence Center, Live Data and Unified CCE Administration. in context
• The Test button on the Single Sign-On page checks that each component can reach the IdP and that Cisco IdS generates access tokens for it. in context
• After IdP metadata is uploaded, the IdS shows SSO Status as Needs Validation until the administrator runs Test SSO Setup, which validates the trust by signing in at the IdP. in context
• Cisco IdS token defaults are 10 hours for refresh tokens (2 to 24), 1 minute for authorization codes (1 to 10) and 60 minutes for access tokens (5 to 120). in context
• Before enabling SSO, the Unified CCE User Integration operation (Cluster Configuration > UCCE User Integration) is run once manually in Unified Intelligence Center to import supervisors with the required roles. in context

Cite this source record

APA

WarmTransfer. (2026, July 31). Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On. WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-ucce-1501-features-sso

BibTeX

@misc{warmtransfer-cisco-ucce-1501-features-sso,
  title  = {Cisco Unified Contact Center Enterprise Features Guide, Release 15.0(1) - Cisco Identity Service for Single Sign-On},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-ucce-1501-features-sso},
  note   = {Cisco Systems, accessed 2026-10-02}
}