Setting Up the Server

This section comprises of the following:

Managing Licenses

To use Cisco Prime Collaboration Provisioning, you must have the Provisioning Image license and one or more scale licenses. The image license must be present or the product remains in the evaluation mode. Scale licenses add to the number of phones you can provision.

Click View detailed feature information (go to Administration > License Management) to view the Feature name, Available count, Used count and Expiry.

In Cisco Prime Collaboration Provisioning Standard, the delegation, workflow, template, and NBI features are listed under unavailable features. When you purchase a license for Cisco Prime Collaboration Provisioning Advanced, these features appear in the valid features list.

Note

If you have a distributed installation, when the network connection between the two servers is lost and then re-established or when only the Provisioning database (the PostgreSQL database) server is restarted, you may get login error for the Provisioning server. Sometimes a license error may appear on the Licensing Status Information page that all features are unavailable. Restart the Provisioning services on the Application server to fix such errors.

When you purchase a license for Cisco Prime Collaboration Provisioning for the first time, the image and scale licenses may be concatenated into a single license file.
You can purchase Provisioning image license and one or more scale licenses to cover the number of phone MAC addresses to be managed. Scale licenses are additive, up to 150,000 per one Provisioning instance. If the image license is not present, the product remains in evaluation mode.
The installed OVA size determines the maximum scale of an instance of Cisco Prime Collaboration Provisioning.
The Application Programmable Interface (API) for Provisioning is called the Cisco Prime Collaboration Provisioning Northbound Interface (Provisioning NBI). It is a set of web service, SOAP-based requests covering most of the provisioning functionality of Provisioning. For detailed information, see the Provisioning NBI document.

If more than one image license file is found in the license directory, Cisco Prime Collaboration Provisioning selects and uses the latest image license file (based on the file date). If the server has more than one image license, duplicates must be removed as they can interfere with each other.

When a license file is added on License Management page, Cisco Prime Collaboration Provisioning validates the license file and displays proper validation message if an error is encountered. Adding the license file may fail in the following scenarios:

Incorrect license file (Assurance license added for Provisioning application)
Incorrect MAC address
Incorrect version of license
License file corrupted or modified
License count mismatch

You can view the manually uploaded license files in the License Management page.

Licensing Process

The following process applies to new installations (and upgrades), and, the scale licenses.

Procedure

Step 1

Obtain a Product Authorization Key (PAK)—The PAK is used to register Cisco Prime Collaboration Provisioning on Cisco.com, and it contains resource limitations.

For each incremental license that you purchase, you will receive a PAK, and you must use that PAK to obtain a license file.

Step 2

Obtain a license file—A license file is sent to you after you register the PAK on Cisco.com.

Step 3

Import the license file to Cisco Prime Collaboration Provisioning from the License Management page. If Cisco Prime Collaboration Provisioning is already installed and you are upgrading your license file, you must import the license file with Cisco Prime Collaboration Provisioning.

Adding a License File to Cisco Prime Collaboration Provisioning

To add a license file to Cisco Prime Collaboration Provisioning:

Procedure

Step 1

Go to License Management page.

In the Cisco Prime Collaboration Provisioning application, select Administration > License Management.

Step 2

On the License Management page, click Add.

Note

If you are updating from the Cisco Prime Collaboration Provisioning Standard mode to the Cisco Prime Collaboration Provisioning Advanced licensed mode, you must add the new license files and later delete all the old license files (see the Upload Time column) listed on the License Management page using the Delete option.

Step 3

In the Add License File window, upload the license file, and click OK.

The newly added license file information appears in the License Status pane. If you purchased more than one license, repeat Step 2 and Step 3 to install each additional license.

To delete a license file, on the License Management page, select the license file and then click Delete.

Switching Between the Standard and Advanced Modes in Cisco Prime Collaboration Provisioning

Prime Collaboration allows you to switch from the Standard mode to the Advanced mode in Cisco Prime Collaboration Provisioning.

The following table captures the different scenarios of switching:

Table 1. Switching from the Standard Mode to the Advanced Mode in Cisco Prime Collaboration Provisioning
Installation Modes	Standard to Advanced Evaluation	Standard to Advanced*	Advanced Evaluation to Advanced*	Advanced Evaluation to Standard
Cisco Prime Collaboration Provisioning	Not Applicable	Yes	Yes	Not Applicable
* To upload the license file for the advanced mode, click Administration > License Management. On the License Management page, click Add and upload the license file.

Cross-launch from Cisco Prime Collaboration Provisioning

With Prime Collaboration 10.0 and above, you can access the Cisco Unified Communication functionality through Cisco Prime Collaboration Provisioning, using the cross-launch feature of Cisco Prime Collaboration Provisioning. Cisco Prime Collaboration Provisioning redirects to the Cisco Unified CM user interface to provision the infrastructure objects, upon clicking the infrastructure objects suitable for cross launching. Any user with admin privilege can cross-launch from Cisco Prime Collaboration Provisioning to use Cisco Unified Communication products. Cross-launch enables a smooth, continuous workflow if an administrator in Cisco Prime Collaboration Provisioning requires access to the device user interface and wants to update a user configuration on the product user interface of the configured devices such as Cisco Unified CM, Unity Connection, or IM and Presence Services.

As an admin user, you can use cross-launch for the following purposes, from Cisco Prime Collaboration Provisioning:

Cross-launching Devices from Infrastructure Configuration
Cross-launching Serviceability from Infrastructure Setup. See Adding Devices.
Cross-launching Related Links in Cisco Unified CM from User Provisioning. See Adding Users.

Note

Cross launching is available for users with administrator privileges only and is supported for Cisco Unified CM, Unity Connection, and Presence Services from 10.0 version onwards. If you add older version (earlier than 10.0) of these devices in Cisco Prime Collaboration Provisioning, you will view native-launch links only, as an admin. Native-launch link is applicable to certain infrastructure objects that can be configured in Cisco Unified CM through Cisco Prime Collaboration Provisioning user interface.

However, Presence Services, with versions earlier than 10.0, are not listed in the Infrastructure Configuration view as native links were not supported in earlier versions of Prime Collaboration.
Enabling Single Sign-On (SSO) for Cross-launch is not mandatory. If you have not enabled SSO for cross-launch, you must specify the login credentials when you cross launch a processor (Cisco Unified Communications Manager, Unity Connection, or Presence Services) for the first time by continuing when you are prompted to add the website in the trusted security certificate list. However, you need not login on successive attempts to cross launch the processor as long as the session is in progress and running. To enable SSO, see Single Sign-On for Cisco Prime Collaboration Provisioning.
Depending on browser settings, the cross-launch may open in new browser tab or a new window. Refer to the browser compatibility in the product documentation of the specific application.

Single Sign-On for Cisco Prime Collaboration Provisioning

Prime Collaboration provides users with admin privileges to enable Single Sign-On (SSO) in Cisco Prime Collaboration Provisioning using Security Assertion Markup Language (SAML).

Prime Collaboration does not support multiserver SAN certificates and end user SAML SSO.

You can enable SSO in Cisco Prime Collaboration Provisioning to cross-launch the following UC applications:

Cisco Unified Communications Manager
Cisco Unity Connection
Cisco IM and Presence

Note

To cross-launch the UC applications without the need for login credentials, ensure that SSO for those applications is configured on the same IdP server as that of Prime Collaboration.

Ensure that the following prerequisites are met before you enable SSO:

At least one LDAP Administrative user exists in the system—through LDAP synchronization in Cisco Prime Collaboration Provisioning.

For information on how to provide administrative privileges to a user in Cisco Prime Collaboration Provisioning, see Managing Users chapter in the Cisco Prime Collaboration Provisioning Guide.
An Identity Provider (IdP) server that enables you to use SSO to access many other applications from a single hosted application and a Service Provider. The Service Provider is a website that hosts the applications.

Following are the supported third-party IdP servers:
- Open Access Manager (OpenAM)
- Ping Identity
- Active Directory Federation Services (ADFS)
- Oracle Identity Manager
For the steps to set up an IdP server, see the SAML SSO Deployment Guide for Cisco Unified Communication Applications, Release 10.0(1).
Download the Identity Provider metadata file from the IdP server and save it in your local system.

To enable Single Sign-on:

Procedure

Step 1

Choose Administration -> Single Sign-on.

Step 2

Click Enable SSO.

A warning message is displayed stating, Enabling SSO redirects you to the IdP server for authentication from the next login. To access the application, you will need to be authenticated successfully.

Note

Enable SSO is disabled if the prerequisites are not met.

Step 3

Click Continue.

Step 4

Follow the steps that are provided in the SSO wizard to enable Single Sign-On.

Locate the IdP metadata file from your local system and click Import IdP Metadata.
Click Download Trust Metadata file.

Launch the IdP server and import the downloaded Trust Metadata file.

Note

This is a manual step for Enabling SSO. Create a Circle of Trust (CoT) in the IdP server and log out before proceeding with the SSO testing.

To run SSO Test Setup, select a username from the Valid Administrative Usernames drop-down.

Note

Using any other username to log in to the IdP server may lock the administrator account.

Click Run SSO Test to test the connectivity among the IdP server, Prime Collaboration Applications, and Single Sign-On.
If you are prompted with an error message, Unable to do Single Sign-On or Federation:
- Manually log in to the IdP server using the end user credentials and check if the authentication is successful.
- Verify if the Trust Metadata file is successfully uploaded in the IdP server.
- Verify if the Prime Collaboration server and the IdP server are part of the same Circle of Trust.
Click Finish.

Troubleshooting and Logs for SSO

When you are logged out of the Prime Collaboration server while enabling SSO, we recommend that you close the browser and relaunch the Prime Collaboration application. Because, though your session expires in the Prime Collaboration server, the IdP server session may be still active.
You can find the log file (ssosp*.log) for Cisco Prime Collaboration Provisioning in the /opt/cupm/sep/logs directory.
While enabling SSO, ensure that the hostname for Prime Collaboration is set and is part of DNS.

When the IdP server is down, you can:

Use the recovery URL- https://<PCserver IP address or host name that is part of DNS>/ssosp/local/login.
Disable Single Sign-On from CMD Utility.

To disable SSO from CMD utility in Prime Collaboration applications:

Navigate to the/opt/cupm/sep/build/bin directory for Cisco Prime Collaboration Provisioning. Add <Operation> and <Value> entries in the cpcmconfigsso.sh file.

Operations can be...

Values can be...

1-To get the Single Sign-On status

Not applicable

2-To get the recovery URL status

Not applicable

3-To set the Single Sign-On status

False

Note

You cannot enable SSO through CLI. Use the UI procedure to enable SSO.

4-To set the recovery URL status

True or False

To disable SSO, run the following command:
```
cpcmconfigsso.sh 3 false
```

Note

The recovery URL is enabled by default. If you want to disable it for security reasons, set it as false.

Changing the SSL Port

To change the port used by Cisco Prime Collaboration Provisioning for SSL:

Procedure

Step 1

In the Cisco Prime Collaboration Provisioning system, open the ssl.conf file located at /opt/cupm/httpd/conf.

Step 2

Change the port number in the following lines:

Listen 443

VirtualHost_default_:443

ServerName www.example.com:443

RewriteRule ^/?(.*) https://%{SERVER_NAME}:443/$1 [R,L]

Note

After you change the port number, you must enter the new port number when you access Cisco Prime Collaboration Provisioning.

Step 3

Save the changes and close the file.

Step 4

Open the httpd.conf file located at /opt/cupm/httpd/conf.

Step 5

Change the port number in the following line:

 RewriteRule ^/?(.*)
                                          				https://%{SERVER_NAME}:443/$1 [R,L]

Step 6

Save the changes and close the file.

Step 7

Restart the Apache server by using the following commands:

/opt/cupm/httpd/bin# ./apachectl -k stop

/opt/cupm/httpd/bin# ./apachectl -k start -DSSL

Configuring Provisioning to Use LDAP and ACS Servers

You can configure Cisco Prime Collaboration Provisioning to use Access Control Server (ACS) or LDAP server to authenticate, read, and synchronize.

Note

If you are adding an ACS server, you must add the Provisioning server as an ACS client (with TACACS).
To enable SSL for LDAP Server:
1. You must upload the LDAP server certificate. For the steps to upload LDAP certificate, refer Upload SSL Certificate.
2. Go to the LDAP Server Configuration page and check the Use SSL check box.
Before deleting an ACS or LDAP server, ensure that it is not assigned to a Domain. ACS or LDAP servers are enabled on a per Domain basis. After adding an ACS or LDAP server, you must assign it to a Domain. All the users in the Domain, are authenticated against that ACS or LDAP server. If an ACS or LDAP server is not associated to a Domain, all the users of that Domain are authenticated locally. Globaladmin is always authenticated locally.
All authentication happens on the Active Directory/LDAP server when a domain has both local users and external users (LDAP or ACS), and if the domain is integrated with Active Directory/LDAP.
We recommend, not to have a domain that has a combination of both local users and external users.

When configuring Provisioning to use Cisco Secure Access Control Server, be aware of the following:

When you click the Test Connection button, only the connectivity of the IP address is checked.
The Shared Secret Key is used only for authentication.
If you entered an incorrect Shared Secret Key, when you try to log into Provisioning, you will get an incorrect secret key error. Use the SSK that is generated while configuring ACS.
Provisioning supports only ACS 5.x.

Configuring Prime Collaboration Provisioning Server Time Zone

You can provide Coordinated Universal Time (UTC), also known as Greenwich Mean Time (GMT), updated with leap seconds.

To change the time zone in the Provisioning server:

Procedure

Step 1

Log into the Prime Collaboration Provisioning server with the Console User Login account.

Step 2

Enter the following command to check the configured timezone:

user $ timedatectl

Step 3

Enter the following command to see the list of supported time zones:

user $ timedatectl list-timezones

Step 4

Enter the following commands to set the time zone for the Prime Collaboration Provisioning server:

user $ timedatectl set-timezone Asia/Kolkata

Step 5

Navigate to cd /opt/cupm/sep.

Step 6

Update the following property in the dfc.properties file to update the offset:

dfc.gui.utc_offset=<applicable offset for your geographic location>

For example, if you are in IST time zone, you must enter: dfc.gui.utc_offset=+0530

Step 7

Restart the services

sudo /opt/cupm/bin/cpcmcontrol.sh stop

sudo /opt/cupm/bin/cpcmcontrol.sh start

Note

You can also restart the services from Prime Collaboration Provisioning>Process Management Page.

To change the time zone in the Provisioning server

To change the time zone in the Provisioning server:

Procedure

	Command or Action	Purpose
Step 1	Log into the Prime Collaboration Provisioning server with the account that you have created during installation. By default, it is the admin account.
Step 2	Enter the following command to see the list of supported time zones:	`cm/admin# show timezones`
Step 3	Enter the following commands to set the time zone for the Prime Collaboration Provisioning server:	`cm/admin(config)# config t` `cm/admin(config)# clock timezone US/Pacific` `cm/admin(config)# exit`
Step 4	Enter the following command to copy running-configuration to startup-configuration:	`cm/admin# write memory`
Step 5	Login into Prime Collaboration Provisioning using root account.
Step 6	Navigate to cd/opt/cupm/sep.
Step 7	Update the following property in the dfc.properties file to update the offset:	`dfc.gui.utc_offset=<applicable offset for your geographic location>` For example, if you are in IST time zone, you must enter: `dfc.gui.utc_offset=+0530`
Step 8	Restart the services	`/etc/init.d/pmservers stop` `/etc/init.d/pmservers start`

Cisco Prime Collaboration Provisioning Guide - Standard and Advanced, 12.2

Bias-Free Language

Book Title

Cisco Prime Collaboration Provisioning Guide - Standard and Advanced, 12.2

Chapter Title