Export UC metadata from Cisco Unified Communications Manager:

1. From Cisco Unified CM Administration, go to System > SAML Single Sign On.

2. For the SSO Mode, select either Cluster wide or Per node.

3. In the Certificates section, choose either Use Tomcat certificate or Use system-generated self-signed certificate.

4. Click Export All Metadata and download the metadata file.

5. After the metadata zip file downloads, unzip the file and verify that you have a separate file for each cluster node.

   Note	If you have the IM and Presence Service deployed in a Standard Deployment (non-centralized), your metadata zip file also includes IM and Presence Service nodes.

If you have deployed the Centralized Deployment for the IM and Presence Service, repeat the previous step on the Unified CM publisher node that is located within your IM and Presence central cluster. This gives you a separate zip file for the IM and Presence Service cluster.

Export UC metadata from Cisco Unity Connection:

1. In Cisco Unity Connection Administration, choose System Settings > SAML Single Sign On.

2. For the SSO Mode, select either Cluster wide or Per Node agreement.

3. Click Export All Metadata and download the metadata file.

   Note	With Clusterwide agreements, you will get an XML file download. With Per Node agreements, you will get a zip file that contains XML files for each Unity Connection cluster node.

Export UC metadata from Cisco Expressway.

1. On the Expressway-C primary peer, go to Configuration > Unified Communications > Configuration.

2. In the MRA Access Control section, set the Authentication path to either SAML SSO authentication or SAML SSO or UCM/LDAP.

3. Set SAML Control to either Cluster or Peer, depending on which type of SAML agreement you want.

4. Click Export SAML data.

5. Download the metadata file to a secure location.

   Note	With Cluster agreements, you will get an XML file download. With Peer agreements, you will get a zip file that contains XML files for each Expressway-C cluster node.

First create a certificate and a private key:

Combine the certificate and the key into a password-protected PFX file, which is required by Azure. Make sure to take note of the password.

Generate a single certificate for all nodes and custom apps in the cluster.

Upload the certificate to the Azure Identity Provider.

In Microsoft Azure at Enterprise applications | All applications , select Add an application.

In the Add an application window, do the following:

1. Click Non-gallery application.

2. Enter the Name of your new application (for example, UnifiedCM_Publisher) and click Add.

In the left navigation bar, click Single sign-on.

Click SAML.

Click Upload metadata file and then browse to the UC metadata XML file for the server for which you are configuring an agreement. After you select and open the file, click Add.

Click Save.

Edit the User Attributes & Claims section.

1. Under Required claim, click on Unique User Identifier (Name ID).

2. For the name identifier format, select Default.

3. For Source attribute, choose user.onpremisessamaccountname.

4. Click Save.

5. Under Additional claims, delete all existing claims. For each claim, click (…) and select Delete. Click OK to confirm.

6. Click Add new claim to add the uid claim.

7. For Name, enter uid.

8. Leave the Namespace field blank.

9. For Source, check the Attribute radio button.

10. From the Source attribute drop-down, select user.givenname.

    Note	uid attribute name depends on the LDAP System Settings configured in the Cisco Unified CM Administration user interface.

11. Click Save.

Click SAML-based Sign-on to return to the SAML summary.

Unified CM, IM and Presence Service, and Unity Connection nodes only. In the the SAML Signing Certificate section, click Edit:

1. Click Import Certificate.

2. In the Certificate field, click the cloud to browse to and open the certificate.pfx file that you created earlier.

3. Enter the password and click Add.

   Note	This must be the only certificate in the list and must be active.

4. If this certificate is not active, click the adjacent dots (…), select Make certificate active and then click Yes.

5. If there are other certificates in the list, click the adjacent dots (…) for those certificates, select Delete Certificate and click Yes to delete those certificates.

6. Click Save.

Expressway only. In the SAML Signing Certificate section, click Edit and set the Expressway options:

1. Set Signing Option to Sign SAML Response and Assertion.

2. Set the Signing Algorithm to the appropriate SHA algorithm. For example, SHA-256.

3. Click Save.

Download the Federation Metadata XML file.

Enable the Application in Azure and Assign Users:

1. In the left navigation bar, select Manage > Properties.

2. Set Enabled for users to sign in? to Yes.

3. Set Visible to users? to No.

4. Click Save.

With per node agreement, repeat this procedure separately for each Cisco Unified Communications Manager, IM and Presence Service, and Cisco Unity Connection node. For clusterwide agreement, perform this procedure a single time with Cisco Unified Communications Manager, IM and Presence Service, and Cisco Unity Connection.

As a final check, after you have created agreements for all of your Cisco UC applications, check the IdP metadata file and make sure that the certificate that you created previously is present in the <X509Certificate> field as the signing certificate in the IdP metadata file. The format is as follows:

<KeyDescriptor use="signing">
<KeyInfo>
<X509Data>
<X509Certificate>
--actual X.509 certificate--
</X509Certificate>
</X509Data>
</KeyInfo>
</KeyDescriptor>

Enable SAML SSO on Cisco Unified Communications Manager:

1. From Cisco Unified CM Administration, navigate to System > SAML Single Sign On.

2. Click Enable SAML SSO, click Continue and follow the prompts.

3. Import the IdP Metadata file into Cisco Unified Communications Manager.

4. Test the SSO connection.

5. Restart the Cisco Tomcat Service.

6. Repeat this step on each Cisco Unified Communications Manager cluster node.

If you have an IM and Presence Centralized Deployment, repeat Step 1 on the Unified CM publisher node that is located in the IM and Presence central cluster.

Enable SAML SSO on Cisco Unity Connection:

1. In Cisco Unity Connection Administration, go to System Settings > SAML Single Sign On.

2. Click Enable SAML Single Sign On.

3. Click Continue and follow the prompts.

4. Import the IdP metadata file into Cisco Unity Connection.

5. Test the SSO Connection.

6. Restart the Cisco Tomcat service.

7. Repeat this procedure on each Cisco Unity Connection node.

Enable SAML SSO on Expressway:

1. On the Expressway-C primary peer go to Configuration > Unified Communications > Identity providers (IdP).

2. Click Import new IdP from SAML.

3. Locate and select the metadata file.

4. Set Digest to the required SHA algorithm and click Upload.

5. Verify that your Identity Provider appears.

6. Click Associate domains.

7. Check each of the domains that you want to associate to this IdP.

8. Click Save.