Cisco Jabber for Mac Installation and Configuration Guide 9.2(1)

Transcription

1 First Published: September 23, 2013 Last Modified: February 25, 2014 Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax:

2 2015 Cisco Systems, Inc. All rights reserved.

3 CONTENTS CHAPTER 1 Overview of Cisco Jabber for Mac 1 Overview of Cisco Jabber for Mac 1 How to use this guide 2 Deploy certificates for Cisco Jabber for Mac 2 CHAPTER 2 Deploy Cisco Jabber for Mac on-demand 5 Overview of Cisco Jabber for Mac on-demand deployment 5 CHAPTER 3 Deploy Cisco Jabber for Mac on-premises 7 Overview of Cisco Jabber for Mac on-premises deployment 7 On-premises deployment checklist 8 Before you deploy 9 Configure Cisco Unified Presence settings 9 Start essential services 10 Firewall requirements for Cisco Jabber for Mac 11 Cisco Jabber for Mac Configuration Requirements 13 Global configuration files 13 Group configuration files 14 Group Configuration File Names 14 Configuration file caching 15 Configuration file examples 15 Cisco Media Services Interface 19 Traffic Marking 19 Prepare Your Network 19 Install Cisco Media Services Interface 20 Configure IM and Availability 20 Configure LDAP Servers 20 Configure LDAP Servers in Cisco Unified Presence 20 iii

4 Contents Configure LDAP Servers in Cisco Unified Communication Manager 21 Add a new service profile in Cisco Unified CM 21 Configure LDAP Servers in Cisco Unified Communication Manager 23 Add Directory Profile to Service Profile in Cisco Unified Communication Manager 23 Configure IM and Presence Servers 25 Add IM and Presence Profile to Service Profile 25 Configure a Secure Connection Between Cisco Unified Presence and the LDAP Directory 26 Create LDAP Configuration 26 Create LDAP Profiles and Add Users in Cisco Unified Presence 8.6 or earlier 26 Create LDAP Profiles and Add Users in Cisco Unified Presence or later 29 Specify LDAP Directory Configuration on Cisco Unified Communications Manager 31 Configure the LDAP Attribute Map 33 LDAP Authentication 34 Indexed Active Directory Attributes 34 Intradomain Federation 35 Configure intradomain federation 35 Intradomain Federation Example 36 Predictive search 36 Cisco Unified Communications Manager User Data Service 37 Enable Integration with UDS 37 Set UDS Service Parameters 38 Contact photo retrieval 38 Retrieve photo with URI substitution 39 Retrieve binary data for photos 39 Configure LDAP Authentication 39 Configure LDAP Synchronization for User Provisioning 40 Enable Instant Messaging Policy 41 Turn IM History Logging On or Off 42 Fetch Contact Pictures from a Web Server 43 Configure IM Policy Settings 43 Optional configurations 44 Third-party XMPP client support 44 iv

5 Contents Requirements for supporting third-party XMPP clients 44 Configure a secure connection between Cisco Unified Presence and XMPP clients 45 Enable support for third-party XMPP clients 45 Telephony 46 Configure CCMCIP profiles 46 Configure CCMCIP profiles in Cisco Unified Presence 46 Configure CCMCIP profiles in Cisco Unified Presence Administration 48 Configure CTI profiles 50 Configure CTI gateway profiles in Cisco Unified Presence 50 Configure CTI Profile in Cisco Unifed Communications Manager 51 Add CTI Profile to Service Profile 52 Desk Phone Control Mode 52 Configuration of Cisco Unified Presence to enable use of desk phone for calls 52 Enable control of desk phone from CTI 52 Using the computer as a phone 53 Enable control of computer as a phone from CTI 53 Create a Cisco Unified Client Services Framework device for each user 53 Naming guidelines for Cisco Unified Client Services Framework devices 55 Associate a new device with a user 55 Associate a line for a phone device with a user 56 Configure the proxy listener and TFTP addresses 56 Configure proxy listener and TFTP addresses for Cisco Unified Presence 57 Configure proxy listener and TFTP addresses for IM and Presence Service 58 Configuration of security for calls 58 Configure security for a device 59 Reset a device 59 Voic 59 Configure Cisco Unity Connection servers 59 Add a Voic Service 61 Apply Voic Service 62 Add a Mailstore Service 63 Apply Mailstore Service 64 Configure Retrieval and Redirection 64 Set a Voic Credentials Source 65 Meetings 66 v

6 Contents Configure the Cisco WebEx Meetings Server 66 Configure Cisco WebEx Meeting Server for Cisco Unified Presence 66 Configure the Cisco WebEx Meeting Server in Cisco Unified CM 67 Add Conferencing Profile to Service Profile 69 Distribute the Cisco Jabber for Mac client 69 vi

7 CHAPTER 1 Overview of Cisco Jabber for Mac Overview of Cisco Jabber for Mac, page 1 How to use this guide, page 2 Deploy certificates for Cisco Jabber for Mac, page 2 Overview of Cisco Jabber for Mac Cisco Jabber for Mac streamlines communications and enhances productivity by unifying availability, instant messaging, voice, video, voice messaging, desktop sharing, and conferencing capabilities securely into one client on your desktop. Cisco Jabber for Mac delivers secure, clear, and reliable communications, offers flexible deployment models, is built on open standards and integrates with commonly used desktop applications. Communicate and collaborate effectively from anywhere you have an Internet connection. Release The following improvements have been made in Cisco Jabber for Mac Release 9.2.1: Video Place and receive Video calls to various video endpoints including EX60 and EX90 phones, and TP bridges Full screen video Moveable picture-in-picture Support for multiple cameras and camera selection Hold and resume video calls Stop and start your video during a call Handle multiple video calls Medianet Metadata 1

8 How to use this guide Overview of Cisco Jabber for Mac How to use this guide This guide is designed to help you install, configure, and perform administrative tasks for Cisco Jabber for Mac. The following table will direct you to the sections of this guide that are relevant to your needs: If you want to: Deploy Cisco Jabber for Mac in an on-demand environment using Cisco Collaboration Cloud Configure or administrate telephony for Cisco Jabber for Mac Configure or administrate voic for Cisco Jabber for Mac Configure or administrate meetings for Cisco Jabber for Mac Distribute the Cisco Jabber for Mac client Consult the following section(s): Overview of Cisco Jabber for Mac on-demand deployment See Getting started with Cisco Unified Communications Manager for Click to Call. See Specifying Visual Voic settings. See Understanding additional services. See Overview of Cisco Jabber for Mac on-demand deployment. Deploy certificates for Cisco Jabber for Mac Cisco Jabber for Mac features a new security enhancement that provides users with a warning dialog in the event that a certificate cannot be validated (due to self-signage, incorrect name or date, or other reasons). As long as the certificate is valid and trusted, the dialog will not appear. Cisco provides users with the opportunity to "Continue" connecting from the warning dialogs when Cisco Jabber for Mac is deployed into networks with self-signed certificates. Users also have the option to mark the self-signed certificate as "Always Trust," which places the certificate in the user's Keychain and eliminates the warning dialog on subsequent launches. Users may become frustrated when presented with several warning dialogs when first launching the product, since Cisco Jabber for Mac connects to many servers. In order to resolve this issue and improve the user experience, Cisco recommends that administrators acquire proper certificates that are issued from a trusted Certificate Authority. When Cisco Jabber for Mac is presented with a valid certificate, it will connect normally without prompting the user (unless the user has chosen the option to see certificates before Cisco Jabber for Mac connects). Alternatively, you can provide self-signed certificates that the user can install on his or her local machine. The user will not encounter the dialog box if the certificates are already in place when Cisco Jabber for Mac launches. Perform the following steps to deploy self-signed certificates to users: 2

9 Overview of Cisco Jabber for Mac Deploy certificates for Cisco Jabber for Mac Download the "tomcat-trust" certificate from the Cisco Unified OS administration interface, under Security > Certificate Management. Download the corresponding certificates from the Cisco Unified Presence, Cisco Unified Communications Manager, and Unity Connection servers, where applicable. Concatenate the certificates into a single file with the extension.pem (for example, "companyabccertificates.pem"). Send the file to your Cisco Jabber for Mac users and ask them to double-click it. Doing so launches the Keychain Access application and imports the certificates. Note: The operating system requires that the user enter the Mac OS X administration password for each certificate that is being imported. 3

10 Deploy certificates for Cisco Jabber for Mac Overview of Cisco Jabber for Mac 4

11 CHAPTER 2 Deploy Cisco Jabber for Mac on-demand Overview of Cisco Jabber for Mac on-demand deployment, page 5 Overview of Cisco Jabber for Mac on-demand deployment You can deploy Cisco Jabber for Mac in an on-demand (or "cloud") environment by using the Cisco WebEx Connect Administration Tool. To learn how to use this tool, consult the Cisco WebEx Connect Administration Guide: You may also download a PDF of the guide. Recommended installation To perform this type of deployment from start to finish, Cisco recommends that you follow the steps below in the order specified: 1 Configure organization information. See Understanding the Configuration Tab. 2 Create and provision users. See Overview of User Management. 3 Configure IM and availability. See Cisco WebEx Connect federation with other instant messaging providers. 4 Configure telephony services. See Getting started with Cisco Unified Communications Manager for Click to Call. 5 Configure voic . See Specifying Visual Voic settings. 6 Configure meetings. See Understanding additional services. Note This is a list of high-level tasks that may not include every aspect of your configuration. Consult the individual links for more information. 5

12 Overview of Cisco Jabber for Mac on-demand deployment Deploy Cisco Jabber for Mac on-demand 6

13 CHAPTER 3 Deploy Cisco Jabber for Mac on-premises This chapter describes how to deploy Cisco Jabber for Mac in an on-premises environment, using Cisco Unified Presence. Overview of Cisco Jabber for Mac on-premises deployment, page 7 On-premises deployment checklist, page 8 Before you deploy, page 9 Cisco Jabber for Mac Configuration Requirements, page 13 Cisco Media Services Interface, page 19 Configure IM and Availability, page 20 Optional configurations, page 44 Distribute the Cisco Jabber for Mac client, page 69 Overview of Cisco Jabber for Mac on-premises deployment You can deploy Cisco Jabber for Mac in an on-premises environment by leveraging the following key Cisco technologies: Cisco Unified Presence or Cisco Unified Communications IM and Presence Cisco Unified Communications Manager Cisco Unity Connection Cisco Webex Meeting Note This guide has been prepared to align with Cisco Unified Presence release 8.6(1). The system administration interface and menu choices described in the procedures that follow may vary with other versions of Cisco Unified Presence. For example, references to Cisco Unified Personal Communicator have been updated to Cisco Jabber in Cisco Unified Presence release 8.6(3). 7

14 On-premises deployment checklist Deploy Cisco Jabber for Mac on-premises Recommended installation To perform this type of deployment, Cisco recommends that you configure your system in the following order: 1 Configure directory (LDAP) services 2 Configure firewall 3 Create and provision users 4 Configure IM and availability 5 Configure optional features (federated IM, telephony, voic , meetings) 6 Distribute the client Note This is a list of high-level tasks that may not include every aspect of your configuration. Consult the On-premises deployment checklist for a more detailed example of a typical deployment. You should also be aware that you will occasionally switch from entering information in the Cisco Unified Presence Administration Tool to entering information in the Cisco Unified Communications Manager Administration Tool. On-premises deployment checklist The following checklist describes a typical on-premises deployment of Cisco Jabber for Mac for your reference. Your organization's deployment may vary. 1 Configure Cisco Unified Presence settings 2 Start essential services, on page 10 3 Configure firewall(s) 4 Deploy certificates for Cisco Jabber for Mac 5 Configure LDAP Servers 6 Configure a Secure Connection Between Cisco Unified Presence and the LDAP Directory 7 Create LDAP profiles and add users 8 Configure the LDAP attribute map 9 Configure LDAP Synchronization for User Provisioning 10 Configure LDAP Authentication 11 Enable Instant Messaging Policy, on page Fetch Contact Pictures from a Web Server 13 Option: Configure federated IM 14 Option: Configure telephony 15 Option: Configure voic 8

15 Deploy Cisco Jabber for Mac on-premises Before you deploy 16 Option: Configure meetings 17 Distribute the Cisco Jabber for Mac client Before you deploy Configure Cisco Unified Presence settings Note You must perform this task in Cisco Unified Presence. Select Cisco Unified Presence Administration > Application > Cisco Unified Personal Communicator > Settings. Enter information into the fields: Field Setting CSF certificate directory (relative to CSF install directory) This field applies only if the Client Services Framework (CSF) requires you to import security certificates to authenticate with LDAP, web conferencing, and CCMCIP. For most deployments, you do not need to import security certificates. You only need to import security certificates for CSF to trust in the following scenarios: You use a signed certificate for Cisco Unified Communications Manager Tomcat instead of the default self-signed certificate. You want CSF to connect to the LDAP server via LDAPS. You use a signed certificate for Cisco Unity Connection Tomcat instead of the default self-signed certificate. If you must specify a value, specify the directory that contains the security certificates as an absolute path. If you do not specify a directory, CSF looks for the certificates in the default directory and trusts any certificates in that location. Default Setting: Not set 9

16 Start essential services Deploy Cisco Jabber for Mac on-premises Credentials source for voic service Credentials source for web conferencing service Maximum message size Allow cut & paste in instant messages If user credentials for the voic service are shared with another service, select the appropriate service from this list box. The user credentials automatically synchronize from the service that you select. Default Setting: Not set Troubleshooting Tips If this value is set to Not set, users must enter their credentials manually using the Preferences menu from the client. If user credentials for the meeting service are shared with another service, select the appropriate service from this list box. The user credentials automatically synchronize from the service that you select. Default Setting: Not set Troubleshooting Tips If this value is set to Not set, users must enter their credentials manually using the Preferences menu from the client. Enter the allowed size limit for instant messages, in bytes. Check this check box to allow users to cut and paste in their instant messages (IMs). Default Setting: On Select Save. Start essential services Note You must perform this task in Cisco Unified Communications Manager. To deploy Cisco Jabber, start the following Cisco Unified Presence Extensible Communication Platform (XCP) services on all Cisco Unified Presence nodes in all clusters: Cisco Unified Presence XCP Authentication Service Cisco Unified Presence XCP Connection Manager You may also start the following optional Cisco Unified Presence XCP services on all Cisco Unified Presence nodes in all clusters, depending on what features you want to make available: 10

17 Deploy Cisco Jabber for Mac on-premises Firewall requirements for Cisco Jabber for Mac Cisco Unified Presence XCP Text Conference Manager, for group chat. Cisco Unified Presence XCP SIP Federation Connection Manager, to support federation services with third-party applications that use SIP. Cisco Unified Presence XCP XMPP Federation Connection Manager, to support federation services with third-party applications that use XMPP. Cisco Unified Presence XCP Counter Aggregator, if you want system administrators to be able to view statistical data on XMPP components. Cisco Unified Presence XCP Message Archiver, for automatic archiving of all instant messages. Note Read the documentation relating to any feature that you are implementing before you turn on the relevant services. Additional configuration might be required. Step 5 Step 6 Step 7 Step 8 Step 9 0 Select Cisco Unified Serviceability > Tools > Control Center - Network Services. Select the desired Cisco Unified Presence server from the Server list box. Select Go. Confirm the Cisco UP XCP Router service is running. If the Cisco UP XCP Router service is not running, do the following: a) Select the radio button next to the Cisco UP XCP Router service in the CUP Services section. b) Select OK. Select Cisco Unified Serviceability > Tools > Service Activation. Select the desired Cisco Unified Presence server from the Server list box. Select Go. Select Cisco UP XCP Directory Service. Select Save. Firewall requirements for Cisco Jabber for Mac Internet traffic moves through a firewall based on service identification numbers that are known as ports. Ports are an organizational concept used categorize and prioritize traffic. The primary purpose of a firewall is to recognize the traffic that moves through it and to allow or deny the traffic based on its port number. Firewalls must be configured to allow traffic on certain ports for Cisco Jabber to work properly. Network administrators typically block all unnecessary traffic on their networks. This involves only opening those ports that are required by enterprise-specific applications and closing all others. There are two types of firewalls that may be encountered in the enterprise environment, software and hardware firewalls. Software firewalls exist as a component of most modern computer operating systems. They are intended to provide a basic level of security at the individual user level. When users run Cisco Jabber for the first time, they may be asked to Accept or Unblock the application. This is the operating system software 11

18 Firewall requirements for Cisco Jabber for Mac Deploy Cisco Jabber for Mac on-premises firewall asking if the application should be allowed to run. Users should be notified of this and provided information on how to properly respond. If users experience problems with availability, phone mode switching, or instant messages, the firewall might be denying connections despite the previous allowed setting. Restart Cisco Jabber. If this does not resolve the issue, return to the Firewall settings, remove Cisco Jabber, and add it again to the list of applications that allow incoming connections. Hardware firewalls are network devices that provide protection from unwanted traffic at an enterprise level. Hardware firewalls must be configured to allow the ports carrying traffic for Cisco Jabber. The following table lists the ports used by Cisco Jabber. These ports must be open on all firewalls for Cisco Jabber to function properly. Port Inbound Outbound Protocol UDP UDP TCP HTTP TCP (HTTPS and XMPP) TCP (HTTPS) UDP/TCP LDAPS TCP TCP UDP/TCP TCP Description Real-Time Transport Protocol (RTP) media streams for audio Trivial File Transfer Protocol (TFTP) service Cisco Unified Communications Manager administrator and user web pages Cisco WebEx Meetings Server for on-premises conferencing Cisco Unity Connection for voic Cisco WebEx Messenger service in cloud-based deployments. Note The client sends XMPP through port 443 in cloud-based deployments. If port 443 is blocked, the client falls back to port 5222 Cisco Unity Connection for notifications of voice messages LDAP directory server LDAP directory server (secure) Global Catalog server CTI gateway Session Initiation Protocol (SIP) call signaling Secure SIP call signaling 12

19 Deploy Cisco Jabber for Mac on-premises Cisco Jabber for Mac Configuration Requirements TCP (XMPP) HTTPS UDP UDP/TCP SOCKS5 Bytestreams TCP HTTP Cisco Unified Presence or Cisco Unified Communications IM and Presence in on-premises deployments Note In on-premises deployments, the client sends XMPP traffic through port In cloud-based deployments, the client uses port 5222 as fallback for XMPP traffic to the Cisco WebEx Messenger service if port 443 is blocked. Connection to Cisco Unified Communications Manager IP Phone (CCMCIP) server to get a list of currently-assigned devices. RTP media streams for audio Domain Name System (DNS) traffic Peer to peer file transfers If port 1080 is in use, the client attempts to use the next available port in the range from 1081 to Locally Significant Certificates (LSC) for IP phones This is the listening port for Cisco Unified Communications Manager Certificate Authority Proxy Function (CAPF) enrollment. The client listens for events from Cisco Unified Client Services Framework. Cisco Jabber for Mac Configuration Requirements Global configuration files In most environments, Cisco Jabber for Mac does not require any configuration. You should create a configuration file for Cisco Jabber for Mac only if the default configuration does not suit your environment or you require custom configuration. Global configuration files apply to all Cisco Jabber for Mac users. Cisco Jabber for Mac downloads the global configuration file from your TFTP server during the login sequence. The default name for the global configuration file is jabber-config.xml. 13

20 Group configuration files Deploy Cisco Jabber for Mac on-premises Group configuration files Group configuration files apply to subsets of Cisco Jabber for Mac users. Group configuration files take priority over global configuration files. Cisco Jabber for Mac retrieves group configuration files after users sign in to their phone account in the client for the first time. Cisco Jabber for Mac then prompts the users to sign out. During the second login sequence, Cisco Jabber for Mac downloads the group configuration file from your TFTP server. Cisco Jabber for Mac loads group configuration files as follows: Users are not signed in 1 Users sign in and then Cisco Jabber for Mac notifies the users about the change to their configuration settings. 2 Users sign out. 3 Users sign in and then Cisco Jabber for Mac loads the group configuration settings. Users are signed in and use Cisco Jabber for Mac for calls 1 Cisco Jabber for Mac notifies the users about the change to their configuration settings. 2 Users sign out. 3 Users sign in and then Cisco Jabber for Mac loads the group configuration settings. Users are signed in and use Cisco Jabber for Mac for calls 1 Users sign out. 2 Users sign in and then Cisco Jabber for Mac notifies the users about the change to their configuration settings. 3 Users sign out. 4 Users sign in and then Cisco Jabber for Mac loads the group configuration settings. If users select the option to use Cisco Jabber for Macs for calls before they sign out, Cisco Jabber for Mac notifies the users to sign out and then sign in again to load the group configuration settings. Group Configuration File Names You specify the name of the group configuration files in the Cisco Support Field on the CSF device configuration in Cisco Jabber for Mac. If you remove the name of the group configuration file in the CSF device configuration on Cisco Jabber for Mac, Cisco Jabber for Mac detects the change, prompts the users to sign out, and loads the global configuration file. You can remove the name of the group configuration file in the CSF device configuration by deleting the entire configurationfile=group_configuration_file_name.xml string or by deleting the group configuration filename from the string. 14

21 Deploy Cisco Jabber for Mac on-premises Configuration file caching Configuration file caching Cisco Jabber for Mac always attempts to download configuration files from your TFTP server during the login sequence. If Cisco Jabber for Mac cannot download a configuration file, it reads the previously loaded configuration from the cache. Cisco Jabber for Mac caches the content of both group and global configuration files in a file named JabberLocalConfig.xml. For this reason, if you create a group configuration file, the contents of that file replace the contents of the global configuration file in the cache. Note Because the group configuration file replaces the global configuration file in the cache, you can lose configuration settings if the group configuration file does not contain the same parameters as the global configuration. For example, you create a global configuration file that contains custom embedded tab definitions. You then create a global configuration file that does not contain those embedded tab definitions. When Cisco Jabber for Mac downloads the group configuration file, those custom embedded tab definitions no longer exist in the configuration that Cisco Jabber for Mac loads. The JabberLocalConfig.xml file is in~/library/application Support/Cisco/Unified Communications/Jabber/CSF/Config The cache file isjabber-config.xml and is cached on the local machine. Configuration file examples EDI/BDI example The following example includes elements for a Windows configuration (EDI) and a non-windows configuration (BDI). EDI and BDI can coexist in the same jabber-config.xml file.. <?xml version="1.0" encoding="utf-8"?> <config version="1.0"> <!-- LDAP Directory configuration for windows platform clients --> <Directory> <!-- EDI Settings--> <PrimaryServerName> </PrimaryServerName> <PresenceDomain>jabbermac75.net</PresenceDomain> <PresenceServer> </PresenceServer> <ServerPort1>389</ServerPort1> <ConnectionUsername>aaaaaaa</ConnectionUsername> <ConnectionPassword>xxxxxx</ConnectionPassword> <SearchBase1>CN=Users,DC=jabbermac75,DC=net</SearchBase1> <!-- BDI Settings--> <BDIPhotoURISubstitutionEnabled>True</BDIPhotoURISubstitutionEnabled> <BDIPhotoURISubstitutionToken>sAMAccountName</BDIPhotoURISubstitutionToken> <BDIPhotoURIWithToken> </BDIPhotoURIWithToken> <BDILDAPServerType>OpenLDAP</BDILDAPServerType> <BDIPrimaryServerName> </BDIPrimaryServerName> <BDIPresenceDomain>jabbermac75.net</BDIPresenceDomain> <BDIServerPort1>389</BDIServerPort1> <BDISearchBase1>CN=Users,DC=jabbermac75,DC=net</BDISearchBase1> <BDIConnectionUsername>admin@jabbermac7.net</BDIConnectionUsername> <BDIConnectionPassword>xxxxxx</BDIConnectionPassword> <BDIEnableTLS>True</BDIEnableTLS> <BDIUseANR>False</BDIUseANR> <BDIPredictiveSearchFilter>mail, displayname</bdipredictivesearchfilter> 15

22 Configuration file examples Deploy Cisco Jabber for Mac on-premises </Directory> </config> Element definitions The following table describes the elements in the jabber-config.xml file example. Note Only the first element, DirectoryServerType, is required. All other keys are optional. Element DirectoryServerType BDIPrimaryServerName BDIServerPort1 BDIConnectionUsername BDIConnectionPassword BDISearchBase1 BDIBaseFilter BDILDAPServerType BDIPresenceDomain BDIPhotoUriSubstitutionEnabled BDIPhotoUriSubstitutionToken Description EDI, BDI or UDS. Only used if PresenceServerType is CUP. EDI is LDAP for Windows clients and BDI is LDAP for non-windows clients IP address of the directory server Port used to connect to the directory server Specifies a username to connect to the directory server. Important: The username is visible in the jabber-config.xml file as plain text. If you specify credentials in the configuration, you should use a shared, read-only directory account for all users. For more information on setting credentials, see LDAP Credentials Configuration Password you can specify to connect to the directory server. Important: The password is visible in the jabber-config.xml file as plain text. If you specify credentials in the configuration, you should use a shared, read-only directory account for all users. For more information on setting credentials, see LDAP Credentials Configuration BaseDN Specifies a base filter for AD/LDAP queries. Use a directory subkey name only to retrieve objects other than user objects when you query AD/LDAP. The default value is (&(objectcategory=person) Configuration files can contain only valid XML character entity references. Use & instead of & if you specify a custom base filter LDAP server type. Possible values are OpenLDAP or AD. Default is AD. LDAP domain True or False. For more information about photos, see the section, Contact Photo Retrieval Specify a directory attribute to use as a dynamic token (for example, samaccountname). For more information about photos, see the section, Contact Photo Retrieval 16

23 Deploy Cisco Jabber for Mac on-premises Configuration file examples BDIPhotoUriWithToken Photo URL template. Specify the URL and the dynamic token as the value of the parameter. Possible values: For more information about photos, see the section, Contact Photo Retrieval BDIEnableTLS BDIPredictiveSearchFilter BDIUseANR BDIUseSIPURIToResolveContacts BDIUriPrefix BDIUseJabberCredentials BDIDomainName BDIUserAccountName Default is False. Use True to enable TLS (Optional) Defines a filter Cisco Jabber for Mac applies to predictive search queries. This key is only used if BDIUseANR is set to False. If BDIUseANR is set to False and BDIPredictiveSearchFilter is not set, Cisco Jabber for Mac uses a default search filter. The default for BDIUseANR is True for AD and False for openldap. When it is set to False, LDAP search is based on the value of the BDIPredictiveSearchFilter set in jabber-config.xml, if that value is set. For more information about ANR, see Predictive Search. Determines if the app should be SIP-aware. True or False. False is default. String that Cisco Jabber for Mac searches for in the Primary Address, typically SIP. Default is an empty string. Default is False. If this is set to True, and credentials are not set in configuration or in Cisco Unified Presence, Cisco Jabber credentials will be used for login. Attribute for domain name. Default is dn Attribute for user name. Defaults: AD: samaccountname OpenLDAP: uid BDIDisplayName Attribute for display name. Defaults: AD: displayname OpenLDAP: cn BDICommonName BDIFirstName BDILastName Attribute for common name. Default is cn for AD; no default for OpenLDAP Attribute for first name. Default is givenname Attribute for last name. Default is sn 17

24 Configuration file examples Deploy Cisco Jabber for Mac on-premises BDINickName BDI Address BDIBusinessPhone BDIMobilePhone Attribute for nickname. Default is nickname for AD; no default for OpenLDAP Attribute for address. Default is mail Attribute for office phone number. Default is telephonenumber Attribute for mobile phone. Defaults: AD: mobile OpenLDAP: mobiletelephonenumber BDIHomePhone Attribute for home phone. Defaults: AD: mobile OpenLDAP: mobiletelephonenumber BDIOtherPhone BDITitle BDICompanyName BDILocation BDOStreetAddress BDIState BDICity BDIPostalCode BDICountry BDIPhotoSource Attribute for other phone. Default is othertelephone for AD; no default for OpenLDAP Attribute for title. Default is title Attribute for company name. Default is company Attribute for location. Default is location Attribute for street address. Default is streetaddress Attribute for state. Default is st Attribute for city. Default is l Attribute for postal code. Default is postalcode Attribute for country. Default is co Attribute for photo source. Defaults: AD: thumbnaiphoto OpenLDAP: jpegphoto To use a photo with AD, remove any BDIPhotoSource attributes in jabber-config.xml. You need not specify thumbnailphoto as the attribute, because Cisco Jabber for Mac uses thumbnailphoto as the default. Simply upload the user image to the thumbnailphoto attribute in AD. For more information about photos, see the section, Contact Photo Retrieval BDISipUri Attribute for SIP URI. Default is msrtcsip-primaryuseraddress UDS example 18

25 Deploy Cisco Jabber for Mac on-premises Cisco Media Services Interface The following example includes a UDS configuration. <?xml version="1.0" encoding="utf-8"?> <config version="1.0"> </config> <Directory> <DirectoryServerType>UDS</DirectoryServerType> <PhotoURISubstitutionEnabled>True</PhotoURISubstitutionEnabled> <PhotoURISubstitutionToken>sAMAccountName</PhotoURISubstitutionToken> <PhotoURIWithToken> </PhotoURIWithToken> <OtherPhone>telephoneNumber</OtherPhone> < Address>mail</ Address> <CcmipServer1> </CcmipServer1> <PresenceDomain>jabbermac75.net</PresenceDomain> </Directory> Cisco Media Services Interface Traffic Marking Cisco Media Services Interface provides a service that works with Cisco Prime Collaboration Manager and Cisco Medianet-enabled routers to ensure that Cisco Jabber can send audio media and video media on your network with minimum latency or packet loss. Before Cisco Jabber sends audio media or video media, it checks for Cisco Media Services Interface. If the service exists on the computer, Cisco Jabber provides flow information to Cisco Media Services Interface. The service then signals the network so that routers classify the flow and provide priority to the Cisco Jabber traffic. If the service does not exist, Cisco Jabber does not use it and sends audio media and video media as normal. Note Cisco Jabber checks for Cisco Media Services Interface for each audio call or video call. Prepare Your Network To install Cisco Media Service Interface for traffic marking, you must prepare your network. Install Cisco Prime Collaboration manager. Install routers or switches enabled for Cisco Medianet where appropriate. Configure your network to handle the metadata attributes that Cisco Media Service Interface applies to applications. 19

26 Install Cisco Media Services Interface Deploy Cisco Jabber for Mac on-premises Not all devices on your network must support Cisco Medianet. The first hop should prioritize traffic based on the metadata attributes from Cisco Media Service Interface. As the traffic traverses the network, all other devices should also prioritize that traffic unless you configure policies on those devices to handle the traffic differently. Install Cisco Media Services Interface Download the Cisco Media Services Interface installation program from the download site on cisco.com. Install Cisco Media Services Interface on each computer on which you install Cisco Jabber. See the appropriate Cisco Medianet documentation for installing Cisco Media Services Interface. Configure IM and Availability Configure LDAP Servers Configure LDAP Servers in Cisco Unified Presence Note Use this procedure for Cisco Unified Presence 8.6 or earlier. If you have installed Cisco Unified Communications Manager IM and Presence Service 9.0 or later, see Configure LDAP Servers in Cisco Unified Communication Manager, on page 21 Before You Begin Configure the LDAP attribute map. Obtain the hostnames or IP addresses of the LDAP directories. 20

27 Deploy Cisco Jabber for Mac on-premises Configure LDAP Servers Step 5 Step 6 Step 7 Select Cisco Unified Presence Administration > Application > Cisco Unified Personal Communicator > LDAP Server. Select Add New. Enter the LDAP server name. Enter an IP address or a Fully Qualified Domain Name (FQDN) of the LDAP server. Select TCP or TLS for the protocol type. Select Save. Related Topics Configure LDAP Servers in Cisco Unified Communication Manager, on page 21 Configure LDAP Servers in Cisco Unified Communication Manager Step 5 Step 6 Step 7 Step 8 Select Cisco Unified Communication Manager > User Management > User Settings > UC Service. Select Add New. Select Directory. Then, click Next. Enter the LDAP server name. Enter the IP address or Fully Qualified Domain Name (FQDN) of the LDAP server. Specify the port number to be used by the LDAP server. The default port is 389 for either TCP or TLS. Select TCP or TLS as the protocol type. Select Save. Add a new service profile in Cisco Unified CM In Unified Communications Management Administration, select User Management > User Settings > Service Profile. The Find and List window opens. Select Add New. Enter the following settings for the service profile fields: 21

28 Configure LDAP Servers Deploy Cisco Jabber for Mac on-premises Field Name Name Entry Details Enter the name of the service profile, which is descriptive enough for you to instantly recognize it. This name is visible on the End User settings window. The field allows all but the following characters: Quote (") Angle brackets (< >) Backslash (\) Ampersand (&) percent (%) Maximum characters is 50 (ASCII only) Description Make this the default service profile for the system (Optional) Enter a description that helps you to distinguish between service profiles when you configure more than one. You can change the description at any time Check this check box to make this service profile the default option for the system. Note If you specify a default service profile, end users who do not have an associated service profile automatically inherit the default service profile settings. Select Save. The Add Successful message appears and Cisco Unified Communications Management creates the service profile in the database. 22

29 Deploy Cisco Jabber for Mac on-premises Configure LDAP Servers Configure LDAP Servers in Cisco Unified Communication Manager Step 5 Step 6 Step 7 Step 8 Select Cisco Unified Communication Manager > User Management > User Settings > UC Service. Select Add New. Select Directory. Then, click Next. Enter the LDAP server name. Enter the IP address or Fully Qualified Domain Name (FQDN) of the LDAP server. Specify the port number to be used by the LDAP server. The default port is 389 for either TCP or TLS. Select TCP or TLS as the protocol type. Select Save. Add Directory Profile to Service Profile in Cisco Unified Communication Manager Select Cisco Unified Communication Manager > User Management > User Settings > Service Profile Select the service profile. Go to Directory Profile. Enter information in the following fields: Field Primary Setting Select a primary directory server from the drop-down list. The list contains the directory servers that you previously configured on the UC Services window. Note If you select User Data Service (UDS) for directory integration, then you can use UDS for directory searches without selecting any primary, secondary, or tertiary servers. Clients connect to UDS using DNS/SRV. Tip: You can specify, instead of (or in addition to) UDS, primary, secondary, or tertiary basic or advanced LDAP UC services. Some clients that use these services might not support UDS. Secondary Select a secondary directory server, if applicable. If you do not set up any backup directory servers, you cannot perform directory searches for Cisco Jabber clients if the first server fails. 23

30 Configure LDAP Servers Deploy Cisco Jabber for Mac on-premises Field Tertiary Use Logged On User Credential Username Password Search Base 1 Recursive Search on All Search Bases Search Timeout (seconds) Setting Select a tertiary directory server, if applicable. If you do not set up any backup directory servers, you cannot perform directory searches for Cisco Jabber clients if the first server fails. (Optional) Check this option to use the user credentials to sign in to the LDAP server. Enter LDAP administrator login name. Enter the LDAP bind password, which is limited to 128 characters. This password for the administrator-level account that you provided in the Bind Distinguished Name string allows users to access this LDAP server. Enter the location where you configured all the LDAP users. This location is a container or directory. Maximum allowable characters is 256. Only use a single OU/LDAP search context. Note Follow these guidelines is you integrate with Microsoft Active Directory: Set O and OU OU must contain users; ou=users, dc=cisco, dc=com). For example, cn=users, DC=EFT-LA,DC=cisco, DC=com Include all users of Cisco Jabber in the search base (Optional) Check this check box to perform a recursive search of the directory, starting at the search base Specify the timeout interval. Default is five seconds. Step 5 Select Save. 24

31 Deploy Cisco Jabber for Mac on-premises Configure LDAP Servers Configure IM and Presence Servers Step 5 Step 6 Step 7 Select Cisco Unified Communication Manager > User Management > User Settings > UC Service. Select Add New. Select IM and Presence.. Then, click Next. Enter the Cisco Unified Communication Manager IM and Presence Administration server name. Enter a description. Enter the IP address or Fully Qualified Domain Name (FQDN) of the Cisco Unified Presence server. Select Save. Add IM and Presence Profile to Service Profile Select Cisco Unified Communication Manager > User Management > User Settings > Service Profile. Select the service profile. Go to IM and Presence Profile. Enter information in the following fields: Field Primary Secondary Tertiary Setting Select a IM and Presence server from the drop-down list. The list contains the IM and Presence servers that you previously configured on the UC Services window. Note An IM and Presence profile cannot mix the IM and Presence server and Webex. Select a secondary IM and Presence server, if applicable. Select a tertiary IM and Presence server, if applicable. 25

32 Configure a Secure Connection Between Cisco Unified Presence and the LDAP Directory Deploy Cisco Jabber for Mac on-premises Configure a Secure Connection Between Cisco Unified Presence and the LDAP Directory Before You Begin Enable SSL for LDAP on Cisco Unified Communications Manager, and upload the LDAP directory certificate to Cisco Unified Communications Manager. Step 5 Step 6 Select Cisco Unified OS Administration > Security > Certificate Management. Select Upload Certificate. Select directory-trust from the Certificate Name menu. Browse and select the LDAP server certificate from your local computer. Select Upload File. Restart the Tomcat service from the CLI using this command: utils service restart Cisco Tomcat Create LDAP Configuration Create LDAP Profiles and Add Users in Cisco Unified Presence 8.6 or earlier Before You Begin Note Use this procedure for Cisco Unified Presence 8.6 or earlier. If you have installed Cisco Unified Presence or later, see Create LDAP Profiles and Add Users in Cisco Unified Presence or later. If you have installed Cisco Unified Communications Manager IM and Presence Service 9.0 or later, see Create LDAP Profiles and Add Users in Cisco Unified Communications Manager IM and Presence Service 9.0 or later. Cisco Jabber connects to an LDAP server on a per-search basis. You can see LDAP server information in the Server Health window in Cisco Jabber (Help > Show System Diagnostics). If Cisco Jabber cannot connect to any of the LDAP servers, it reports the failure in the System Diagnostics window. Specify the LDAP server names and addresses. 26

33 Deploy Cisco Jabber for Mac on-premises Create LDAP Configuration Select Cisco Unified Presence Administration > Application > Cisco Unified Personal Communicator > LDAP Profile. Select Add New. Enter information into the fields. Field Setting Name Description Bind Distinguished Name Anonymous Bind Password Enter the profile name limited to 128 characters. (Optional) Enter a description limited to 128 characters. (Optional) Enter administrator-level account information limited to 128 characters. This is the distinguished name with which you bind for authenticated bind. The syntax for this field depends on the type of LDAP server that you deploy. For details, see the LDAP server documentation. (Optional) Uncheck this option to use the user credentials to sign in to this LDAP server. For non-anonymous bind operations, Cisco Jabber receives one set of credentials. If configured, these credentials must be valid on the backup LDAP servers. Note If you check Anonymous Bind, users can sign in anonymously to the LDAP server with read-only access. Anonymous access might be possible on your directory server, but Cisco does not recommend it. Instead, create a user with read-only privileges on the same directory where the users to be searched are located. Specify the directory number and password in Cisco Unified Presence for Cisco Jabber to use. (Optional) Enter the LDAP bind password limited to 128 characters. This is the password for the administrator-level account that you provided in the Bind Distinguished Name string to allow users to access this LDAP server. 27

34 Create LDAP Configuration Deploy Cisco Jabber for Mac on-premises Confirm Password Search Context Recursive Search Primary LDAP Server Make this the Default LDAP Profile for the System Add Users to Profile Reenter the same password as the password you entered in the Password field. (Optional) After configuring Cisco Unified Presence for authenticated bind with the LDAP server, configure the LDAP server for anonymous permissions and anonymous login so that all directory information (name, number, mail, fax, home number, and so forth) is passed to the Cisco Jabber client. (Optional) Enter the location where you configured all the LDAP users. This location is a container or directory. The name is limited to 256 characters. Only use a single OU/LDAP search context. Note If you integrate with Microsoft Active Directory: Set O and OU (OU must contain users; for example, ou=users, dc=cisco, dc=com). For example, cn=users, DC=EFT-LA,DC=cisco, DC=com Include all users of Cisco Jabber in the search base. (Optional) Check to perform a recursive search of the directory starting at the search base. Select the primary LDAP server. (Optional) Check to add any new users to the system into this default profile. If you turn on this setting, Cisco Unified Presence adds any users that it synchronizes from Cisco Unified Communications Manager to this default profile. Cisco Unified Presence adds users to this default profile only after you select the default profile (and you turn on the Sync Agent). Cisco Unified Presence does not change any existing profile configuration. Therefore, Cisco recommends that you select and configure the default profile before you turn on the Sync Agent. Select the button to open the Find and List Users window. Select Find to populate the search results fields. Alternatively, search for a specific users and select Find. To add users to this profile, select the users, and then select Add Selected. Select Save. 28

35 Deploy Cisco Jabber for Mac on-premises Create LDAP Configuration Create LDAP Profiles and Add Users in Cisco Unified Presence or later Before You Begin Note Use this procedure for Cisco Unified Presence or later. If you have installed Cisco Unified Presence 8.6 or earlier, see Create LDAP Profiles and Add Users in Cisco Unified Presence 8.6 or earlier. If you have installed Cisco Unified Communications Manager IM and Presence Service 9.0 or later, see Create LDAP Profiles and Add Users in Cisco Unified Communications Manager IM and Presence Service 9.0 or later. You can see LDAP server information in the Server Health window in Cisco Jabber (Help > Show System Diagnostics). If Cisco Jabber cannot connect to any of the LDAP servers, it reports the failure in the System Diagnostics window. Specify the LDAP server names and addresses. Select Cisco Unified Presence Administration > Application > Cisco Jabber > LDAP Profile. Select Add New. Enter information into the fields. Field Setting Name Description Bind Distinguished Name Enter the profile name limited to 128 characters. (Optional) Enter a description limited to 128 characters. (Optional) Enter administrator-level account information limited to 128 characters. This is the distinguished name with which you bind for authenticated bind. The syntax for this field depends on the type of LDAP server that you deploy. For details, see the LDAP server documentation. 29

36 Create LDAP Configuration Deploy Cisco Jabber for Mac on-premises Anonymous Bind Password Confirm Password Search Context Recursive Search Primary LDAP Server (Optional) Uncheck this option to use the user credentials to sign in to this LDAP server. For non-anonymous bind operations, Cisco Jabber receives one set of credentials. If configured, these credentials must be valid on the backup LDAP servers. Note If you check Anonymous Bind, users can sign in anonymously to the LDAP server with read-only access. Anonymous access might be possible on your directory server, but Cisco does not recommend it. Instead, create a user with read-only privileges on the same directory where the users to be searched are located. Specify the directory number and password in Cisco Unified Presence for Cisco Jabber to use. (Optional) Enter the LDAP bind password limited to 128 characters. This is the password for the administrator-level account that you provided in the Bind Distinguished Name string to allow users to access this LDAP server. Reenter the same password as the password you entered in the Password field. (Optional) After configuring Cisco Unified Presence for authenticated bind with the LDAP server, configure the LDAP server for anonymous permissions and anonymous login so that all directory information (name, number, mail, fax, home number, and so forth) is passed to the Cisco Jabber client. (Optional) Enter the location where you configured all the LDAP users. This location is a container or directory. The name is limited to 256 characters. Only use a single OU/LDAP search context. Note If you integrate with Microsoft Active Directory: Set O and OU (OU must contain users; for example, ou=users, dc=cisco, dc=com). For example, cn=users, DC=EFT-LA,DC=cisco, DC=com Include all users of Cisco Jabber in the search base. (Optional) Check to perform a recursive search of the directory starting at the search base. Select the primary LDAP server. 30

37 Deploy Cisco Jabber for Mac on-premises Create LDAP Configuration Make this the Default LDAP Profile for the System Add Users to Profile (Optional) Check to add any new users to the system into this default profile. If you turn on this setting, Cisco Unified Presence adds any users that it synchronizes from Cisco Unified Communications Manager to this default profile. Cisco Unified Presence adds users to this default profile only after you select the default profile (and you turn on the Sync Agent). Cisco Unified Presence does not change any existing profile configuration. Therefore, Cisco recommends that you select and configure the default profile before you turn on the Sync Agent. Select the button to open the Find and List Users window. Select Find to populate the search results fields. Alternatively, search for a specific users and select Find. To add users to this profile, select the users, and then select Add Selected. Select Save. Specify LDAP Directory Configuration on Cisco Unified Communications Manager If your environment includes Cisco Unified Communications Manager version 9.x and higher, you can specify credentials when you add a directory service. The client can then get the configuration from the server to authenticate with the directory source. If you have installed Cisco Unified Presence 8.6 or earlier, see Create LDAP Profiles and Add Users in Cisco Unified Presence 8.6 or earlier. If you have installed Cisco Unified Presence or later, see Create LDAP Profiles and Add Users in Cisco Unified Presence or later. Complete the steps to add a directory service, apply the directory service to the service profile, and specify the LDAP authentication configuration for the directory service. Open the Cisco Unified CM Administration interface. Add a directory service as follows: a) Select User Management > User Settings > UC Service. The Find and List UC Services window opens. b) Select Add New. The UC Service Configuration window opens. c) In the Add a UC Service section, select Directory from the UC Service Type drop-down list. d) Select Next. e) Specify details for the directory service as follows: 31

38 Create LDAP Configuration Deploy Cisco Jabber for Mac on-premises Product Type Select Directory. Name Enter a descriptive name for the server, for example, PrimaryDirectoryServer. Description Enter an optional description. Hostname/IP Address Enter the address of the directory server in one of the following formats: Hostname IP Address FQDN Protocol Type Select one of the following protocols from the following drop-down list: TCP UDP f) Select Save. Apply the directory service to your service profile as follows: a) Select User Management > User Settings > Service Profile. The Find and List Service Profiles window opens. b) Find and select your service profile. The Service Profile Configuration window opens. c) In the Directory Profile section, select up to three services from the following drop-down lists: Primary Secondary Tertiary d) Specify the credentials that the client can use to authenticate with the LDAP server in the following fields: Username Password e) Select Save. Apply the service profile to users as follows: a) Select User Management > End User. The Find and List Users window opens. 32

39 Deploy Cisco Jabber for Mac on-premises Configure the LDAP Attribute Map b) Find and select your user. The End User Configuration window opens. c) In the Service Settings section, select the service profile from the UC Service Profile drop-down list. Important Cisco Unified Communications Manager version 9.x only: If the user has only instant messaging and presence capabilities (IM only), you must select Use Default. For IM only users, Cisco Unified Communications Manager version 9.x always applies the default service profile regardless of what you select from the UC Service Profile drop-down list. d) Select Save. Configure the LDAP Attribute Map Note You must perform this task in Cisco Unified Presence. Before You Begin Note You can map an LDAP field to only one Cisco Jabber field. Select Cisco Unified Presence Administration > Application > Cisco Unified Personal Communicator > Settings. Select a supported LDAP server from Directory Server Type. The LDAP server populates the LDAP attribute map with Cisco Jabber user fields and LDAP user fields. If necessary, make modifications to the LDAP field to match your specific LDAP directory. The values are common to all LDAP server hosts. Note the following LDAP directory product mappings: Product Microsoft Active Directory iplanet, Sun ONE or OpenLDAP LastName Mapping SN SN UserID Mapping samaccountname uid Select Save. 33

40 LDAP Authentication Deploy Cisco Jabber for Mac on-premises Troubleshooting Tips If you want to stop using the current attribute mappings and use the factory default settings, select Restore Defaults. LDAP Authentication You can set the credentials that are required for LDAP authentication in several ways for Cisco Jabber for Mac. The following sequence describes the order of how the credentials are obtained: 1 LDAP credentials from CUP: Set Credentials in CUP for LDAP authentication. This is a secure way of setting and accessing the credentials for LDAP authentication. For more details on how to set the LDAP credentials in CUP see "Create LDAP Profiles and Add User." 2 LDAP credentials from configuration file: Set the credentials in the configuration file. The credentials are read from the parameters BDIConnectionUsername and BDIConnectionUsername. The username and password are visible in the configuration file as plain text. If you specify credentials in the configuration, you should use a shared, read-only directory account for all users. Note If the LDAP credentials are set in CUP (see #1 above) then the credentials set in the configuration file will be ignored. 3 Cisco Jabber credentials as LDAP credentials: Set BDIUseJabberCredentials to True in the configuration file to use Cisco Jabber credentials for LDAP authentication. Note If credentials are set in #1 or #2, above, the Cisco Jabber credentials are not used for LDAP authentication. 4 Anonymous bind: Anonymous bind is used to connect to LDAP. Anonymous binding happens only if the LDAP credentials were not set using any of the methods mentioned above. Indexed Active Directory Attributes The following Active Directory attributes must be indexed: samaccountname displayname mail Any attributes that are used for contact resolution must also be indexed. For example, you might need to index the following attributes: telephonenumber ipphone, if this attribute is used in your environment 34

41 Deploy Cisco Jabber for Mac on-premises Intradomain Federation Intradomain Federation Intradomain federation enables users within the same domain to share availability and send instant messages between Cisco Unified Presence and Microsoft Office Communications Server, or Microsoft Lync Server, or other presence server. Intradomain federation allows you to migrate users to Cisco Unified Presence or Cisco Unified Communications IM and Presence from a different presence server. For this reason, you configure intradomain federation for Cisco Jabber for Mac on the presence server. See the following documents for more information: Cisco Unified Presence: Integration Guide for Configuring Partitioned Intradomain Federation for Cisco Unified Presence Release 8.6 and Microsoft LCS/OCS Cisco Unified Communications IM and Presence: Partitioned Intradomain Federation for IM and Presence Service on Cisco Unified Communications Manager Configure intradomain federation In addition to configuring intradomain federation on the presence server, you might need to specify some configuration settings in the Cisco Jabber for Mac configuration files. To resolve contacts during contact search or retrieve contact information from your directory, Cisco Jabber for Mac requires the contact ID for each user. Cisco Unified Presence uses a specific format for resolving contact information that does not always match the format on other presence servers such as Microsoft Office Communications Server or Microsoft Lync. Command or Action Set the value of the UseSIPURIToResolveContacts parameter to true. Specify an attribute that contains the contact ID that Cisco Jabber for Mac uses to retrieve contact information as the value of the SipUri parameter. The default value is msrtcsip-primaryuseraddress. Specify any text that prefixes each contact ID as the value of the UriPrefix parameter. The prefix is any text that exists before the username in the contact ID. Purpose For example, you specify msrtcsip-primaryuseraddress as the value of SipUri. In your directory the value of msrtcsip-primaryuseraddress for each user has the following format: sip:username@domain. Sample Configuration The following XML snippet provides an example of the resulting configuration: <Directory> <UseSIPURIToResolveContacts>true</UseSIPURIToResolveContacts> 35

42 Predictive search Deploy Cisco Jabber for Mac on-premises <SipUri>non-default-attribute</SipUri> <UriPrefix>sip:</UriPrefix> </Directory> Intradomain Federation Example This topic provides an example of intradomain federation contact resolution using the SipUri, UseSIPURIToResolveContacts, and UriPrefix parameters. In this example, your configuration has the following settings: The value of the SipUri parameter is msrtcsip-primaryuseraddress. The value of the UseSIPURIToResolveContacts parameter is true. The value of the UriPrefix parameter is sip:. The directory contains as the value of the msrtcsip-primaryuseraddress attribute for a user named Mary Smith. Cisco Jabber for Mac connects to your directory to resolve contact information 1 Your presence server passes msmith@domain.com to Cisco Jabber for Mac 2 Cisco Jabber for Mac appends sip: to msmith@domain.com and then queries your directory 3 sip:msmith@domain.com matches the value of the msrtcsip-primaryuseraddress attribute 4 Cisco Jabber for Mac retrieves contact information for Mary Smith. Cisco Jabber for Mac users search for Mary Smith Cisco Jabber for Mac removes the prefix of sip: from sip:msmith@domain.com and gets the contact ID of msmith@domain.com Predictive search When Cisco Jabber for Mac performs a predictive search, it issues a query using Ambiguous NameResolution (ANR). This query disambiguates the search string and returns results that match the attributes that are set for ANR on your directory server Note You must configure your directory server to set attributes for ANR if you want the client to search for those attributes. See the following Microsoft documentation for more information on ANR: Ambiguous Name Resolution for LDAP in Windows 2000 DAP Referrals, see the Ambiguous Name Resolution section Common Default Attributes Set for Active Directory and Global Catalog 36

43 Deploy Cisco Jabber for Mac on-premises Cisco Unified Communications Manager User Data Service Cisco Unified Communications Manager User Data Service UDS is a REST interface on Cisco Unified Communications Manager that provides contact resolution. You synchronize contact data into Cisco Unified Communications Manager from a directory server. Cisco Jabber for Mac then automatically retrieves that contact data directly from UDS. Note A known issue in UDS exists on versions of Cisco Unified Communications Manager lower than This known issue prevents successful contact resolution. Enable Integration with UDS To enable integration with UDS, perform the following steps: Create your directory source in Cisco Unified Communications Manager. Synchronize the contact data to Cisco Unified Communications Manager. After the synchronization occurs, your contact data resides in Cisco Unified Communications Manager. Provision users with CCMCIP profiles on Cisco Unified Presence or Cisco Unified Communications IM and Presence The client requires a CCMCIP profile that contains the primary Cisco Unified Communications Manager server address. The client uses the CCMCIP profile to locate Cisco Unified Communications Manager and resolve contacts with UDS. 37

44 Contact photo retrieval Deploy Cisco Jabber for Mac on-premises Step 5 Specify UDS as the value of the DirectoryServerType parameter in your configuration file. The following is an example configuration where UDS is the directory server type: <Directory> <DirectoryServerType>UDS</DirectoryServerType> </Directory> Configure the client to retrieve contact photos with UDS. The following is an example configuration for contact photo retrieval: <PhotoUriWithToken> </PhotoUriWithToken> Set UDS Service Parameters You can set service parameters for UDS on Cisco Unified Communications Manager. Open the Cisco Unified Communications Manager Administration interface. Select System > Enterprise Parameters. The Enterprise Parameters Configuration window opens. Locate the User Data Service Parameters section and enter information according to the following table. Parameter Enable All User Search User Search Limit Number of Digits to Match Description Allows searches for all users in the directory. Limits the number of users returned in a query. Specifies the number of digits to match when users search for phone numbers. Note To resolve PSTN numbers, you should set the value as equal to the number of digits in the PSTN numbers. For example, if the PSTN numbers have 10 digits, set the value to 10. Contact photo retrieval Cisco Jabber for Mac retrieves and displays contact photos with the following methods: 38

45 Deploy Cisco Jabber for Mac on-premises Configure LDAP Authentication Retrieve photo with URI substitution Cisco Jabber for Mac can dynamically build a URL to locate contact photos with a directory attribute and a URL template. To use this method, set the following values in your configuration file: Specify true as the value of the BDIPhotoUriSubstitutionEnabled parameter. Specify a directory attribute to use as a dynamic token as the value of the BDIPhotoUriSubstitutionToken parameter Example: <BDIPhotoUriSubstitutionToken>sAMAccountName</BDIPhotoUriSubstitutionToken> Specify the URL and the dynamic token as the value of the BDIPhotoUriWithToken parameter. Example: <BDIPhotoUriWithToken> > In this example, the samaccountname attribute might resolve to msmith in your directory. Cisco Jabber for Mac would take this value and replace the token to build the following URL: Retrieve binary data for photos Cisco Jabber for Mac can retrieve the binary data for a photo from your database. To use this method for contact photo retrieval, make sure that the following parameters are not used in the configuration: BDIPhotoUriWithToken BDIPhotoUriSubstitutionToken BDIPhotoUriSubstitutionEnabled Cisco Jabber for Mac uses the value of the BDIPhotoSource parameter from the configuration file. For example, <BDIPhotoSource>jpegPhoto</BDIPhotoSource>. By default the value of this BDIPhotoSource parameter is thumbnailphoto for AD and jpegphoto for openldap. Configure LDAP Authentication Note You must perform this task in Cisco Unified Communications Manager. 39

46 Configure LDAP Synchronization for User Provisioning Deploy Cisco Jabber for Mac on-premises The LDAP authentication feature enables Cisco Unified Communications Manager to authenticate user passwords against the corporate LDAP directory. Note LDAP authentication does not apply to the passwords of application users; Cisco Unified Communications Manager authenticates application users in its internal database. Before You Begin Enable LDAP synchronization on Cisco Unified Communications Manager. Step 5 Select Cisco Unified Communications Manager Administration > System > LDAP > LDAP Authentication. Check Use LDAP Authentication for End Users. Configure the LDAP authentication settings. Configure the LDAP server hostname or IP address, and port number. Note To use Secure Socket Layer (SSL) to communicate with the LDAP directory, check Use SSL. Click Save. Troubleshooting Tip If you configure LDAP over SSL, upload the LDAP directory certificate to Cisco Unified Communications Manager. Configure LDAP Synchronization for User Provisioning Note You must perform this task in Cisco Unified Communications Manager. LDAP synchronization uses the Cisco Directory Synchronization (DirSync) tool on Cisco Unified Communications Manager to synchronize information (either manually or periodically) from a corporate LDAP directory. When you enable the DirSync service, Cisco Unified Communications Manager automatically provisions users from the corporate directory. Cisco Unified Communications Manager still uses its local database but disables its facility to allow you to create user accounts. You use the LDAP directory interface to create and manage user accounts. Make sure that you install the LDAP server before you attempt the LDAP-specific configuration on Cisco Unified Communications Manager. LDAP synchronization does not apply to application users on Cisco Unified Communications Manager. Activate and start the Cisco DirSync service on Cisco Unified Communications Manager. 40

47 Deploy Cisco Jabber for Mac on-premises Enable Instant Messaging Policy Note You must manually provision application users in Cisco Unified Communications Manager Administration. Step 5 Step 6 Step 7 Step 8 Select Cisco Unified Communications Manager Administration > System > LDAP > LDAP System. Select Add New. Configure the LDAP server type and attribute. Select Enable Synchronizing from LDAP Server. Click Save. Select Cisco Unified Communications Manager Administration > System > LDAP > LDAP Directory. Select Add New. Configure the following items: LDAP directory account settings User attributes to be synchronized Synchronization schedule LDAP server hostname or IP address, and port number Step 9 0 Check Use SSL if you want to use Secure Socket Layer (SSL) to communicate with the LDAP directory. Click Save. Troubleshooting Tips If you configure LDAP over SSL, upload the LDAP directory certificate onto Cisco Unified Communications Manager. See the LDAP directory content in the Cisco Unified Communications Manager SRND for information on the account synchronization mechanism for specific LDAP products, and general best practices for LDAP synchronization. Enable Instant Messaging Policy Note You must perform this task in Cisco Unified Presence. This procedure describes how to turn on or off IM capabilities for all IM client applications in a Cisco Unified Presence cluster. IM capabilities are turned on by default on Cisco Unified Presence. 41

48 Turn IM History Logging On or Off Deploy Cisco Jabber for Mac on-premises Caution When you turn off IM capabilities on Cisco Unified Presence, all group chat functionality (ad hoc and persistent chat) will not work on Cisco Unified Presence. Cisco recommends that you do not turn on the Cisco UP XCP Text Conference service or configure an external database for persistent chat on Cisco Unified Presence. Select Cisco Unified Presence Administration > Messaging > Settings. Configure the IM settings as follows: If You Want To Turn on IM capabilities for client applications in the Cisco Unified Presence cluster. If you turn on this setting, local users of client applications can send and receive IMs. If you turn off this setting, local users of client applications cannot send and receive IMs. Users can use the IM application for availability and phone operations only. Do This Check Enable instant messaging. Select Save. Restart the Cisco UP XCP Router service. Turn IM History Logging On or Off Note You must perform this task in Cisco Unified Presence. You can prevent or allow users to log IM history locally on their computer. On the client side, the application must support this functionality; it must enforce the prevention of IM logging. Select Cisco Unified Presence Administration > Messaging > Settings. Configure the IM history log as follows: If You Want To Do This Allow users of client applications to log IM history on Cisco Unified Presence. Check Allow clients to log instant message history (on supported clients only). 42