To use Prime Collaboration Provisioning, you must have the Provisioning Image license and one or more scale licenses. The image license must be present or the product will remain in the evaluation mode. Scale licenses add to the number of phones you can provision.

Click View detailed feature information (go to Administration > License Management) to view the Feature name, Available count, Used count and Expiry.

In Prime Collaboration Provisioning Standard, the delegation, workflow, template, and nbi features are listed under unavailable features. When you purchase a license for Prime Collaboration Provisioning Advanced, these features will appear in the valid features list.

Note

If you have a distributed installation, when the network connection between the two servers is lost and then reestablished or when only the Provisioning database (the PostgreSQL database) server is restarted, you will not be able to log into the Provisioning server, and sometimes a license error appears on the Licensing Status Information page. The error message states that all features are unavailable. When this occurs, restart the Provisioning services on the Application server.

• When you purchase a license for Prime Collaboration Provisioning for the first time, the image and scale licenses may be concatenated into a single license file.

• You can purchase Provisioning image license and one or more scale licenses to cover the number of phone MAC addresses to be managed. Scale licenses are additive, up to 150,000 per one Provisioning instance. The image license must be present or the product will remain in evaluation mode.

• The maximum scale of an instance of Prime Collaboration Provisioning is determined by the OVA size installed.

• The Application Programmable Interface (API) for Provisioning is called the Cisco Prime Collaboration Provisioning Northbound Interface (Provisioning NBI). It is a set of web service, SOAP-based requests covering the majority of Provisioning’s provisioning functionality. For detailed information see the Provisioning NBI document.

If more than one image license file is found in the license directory, Prime Collaboration Provisioning will pick and use the latest image license file (based on the file date).

You can view the manually uploaded license files in the License Management page.

With Prime Collaboration 10.0 and above, you can access the Cisco Unified Communication functionality through Prime Collaboration Provisioning, using the cross-launch feature of Prime Collaboration Provisioning. Cisco Prime Collaboration Provisioning redirects to the Cisco Unified CM user interface to provision the infrastructure objects, upon clicking the infrastructure objects suitable for cross launching. Any user with admin privilege can cross-launch from Prime Collaboration Provisioning to use Cisco Unified Communication products. Cross-launch enables a smooth, continuous workflow if an administrator in Prime Collaboration Provisioning requires access to the device user interface and wants to update a user configuration on the product user interface of the configured devices such as Cisco Unified CM, Unity Connection, or IM and Presence Services.

As an admin user, you can use cross-launch for the following purposes, from Prime Collaboration Provisioning:

• Cross-launching Devices from Infrastructure Configuration
• Cross-launching Serviceability from Infrastructure Setup. See Adding Devices.
• Cross-launching Related Links in Cisco Unified CM from User Provisioning. See Adding Users.

Note

Cross launching is available for users with administrator privileges only and is supported for Cisco Unified CM, Unity Connection and Presence Services from 10.0 version onwards. If you add older version (earlier than 10.0) of these devices in Prime Collaboration Provisioning, you will view native- launch links only, as an admin. Native-launch link is applicable to certain infrastructure objects that can be configured in Cisco Unified CM through Cisco Prime Collaboration Provisioning user interface. However, Presence Services, with versions earlier than 10.0, are not listed in the Infrastructure Configuration view as native links were not supported in earlier versions of Prime Collaboration. Enabling Single Sign-On (SSO) for Cross-launch is not mandatory. If you have not enabled SSO for cross-launch, you must specify the login credentials when you cross launch a processor (Cisco Unified Communications Manager, Unity Connection, or Presence Services) for the first time by continuing when you are prompted to add the website in the trusted security certificate list. However, you need not login on successive attempts to cross launch the processor as long as the session is in progress and running. To enable SSO, see Single Sign-On for Prime Collaboration Provisioning. Depending on browser settings, the cross-launch may open in new browser tab or a new window. Refer to the browser compatibility in the product documentation of the specific application.

Prime Collaboration provides users with admin privileges to enable Single Sign-On (SSO) in Prime Collaboration Provisioning using Security Assertion Markup Language (SAML).

Prime Collaboration does not support multiserver SAN certificates and end user SAML SSO.

You can enable SSO in Prime Collaboration Provisioning to cross-launch the following UC applications:

• Cisco Unified Communications Manager
• Cisco Unity Connection
• Cisco Unified Presence

Note	To cross-launch the UC applications without the need for login credentials, ensure that SSO for those applications are configured on the same IdP server as that of Prime Collaboration.

Ensure that the following prerequisites are met before you enable SSO:

• At least one LDAP Administrative user exists in the system—through LDAP synchronization in Prime Collaboration Provisioning.

  For information on how to provide administrative privileges to a user in Prime Collaboration Provisioning, see Managing Users chapter in the Cisco Prime Collaboration Provisioning Guide.

• An Identity Provider (IdP) server that enables you to use SSO to access many other applications from a single hosted application and a Service Provider. The Service Provider is a website that hosts the applications.
  Following are the supported third-party IdP servers:

  • Open Access Manager (OpenAM)
  • Ping Identity
  • Active Directory Federation Services (ADFS)
  • Oracle Identity Manager

  For the steps to setup an IdP server, see the SAML SSO Deployment Guide for Cisco Unified Communication Applications, Release 10.0(1).

• Download the Identity Provider metadata file from the IdP server and save it in your local system.

To enable Single Sign-on:

Troubleshooting and Logs for SSO

• When you are logged out of the Prime Collaboration server while enabling SSO, we recommend that you close the browser and re-launch the Prime Collaboration application. Because, though your session expires in Prime Collaboration server, the IdP server session might still be active.
• You can find the log file (ssosp*.log) for Prime Collaboration Provisioning in the /opt/cupm/sep/logs directory.
• While enabling SSO, ensure that the hostname for Prime Collaboration is set and is part of DNS.

• Use the recovery URL- https://<PCserver IP address or host name that is part of DNS>/ssosp/local/login.
• Disable Single Sign-On from CMD Utility.

• To disable SSO, run the following command:

cpcmconfigsso.sh 3 false

Note	By default, the recovery URL is enabled. If you want to disable it for security reasons, set it as false.

You can configure Prime Collaboration Provisioning to use Access Control Server (ACS) or LDAP server to authenticate, read, and synchronize.

Note

If you are adding an ACS server, you must add the Provisioning server as an ACS client (with TACACS). To enable SSL for LDAP Server, You must upload the LDAP server certificate. For the steps to upload LDAP certificate, refer Upload SSL Certificate Go to the LDAP Server Configuration page and check the Use SSL check box. Before deleting an ACS or LDAP server, ensure that it is not assigned to a Domain. ACS or LDAP servers are enabled on a per Domain basis. After adding an ACS or LDAP server, you must assign it to a Domain. All the users then, in a Domain, will be authenticated against that ACS or LDAP server. If an ACS or LDAP server is not associated to a Domain, all the users of that Domain are authenticated locally. globaladmin is always authenticated locally. All authentication happens on the Active Directory/LDAP server when a domain has both local users and external users (LDAP or ACS), and if the domain is integrated with Active Directory/LDAP. We recommend, not to have a domain that has a combination of both local users and external users.