Cisco Connect Ottawa 2018 jabberv2

Cisco Connect Ottawa
Canada • 2 October 2018
Global vision.
Local knowledge.
Isidro Fernández
Cisco Advanced Services – Collaboration Technologies

© 2 0 1 8 C is c o a n d / o r it s a f f ilia t e s . A ll r ig h t s r e s e r v e d . C is c o C o n f id e n t ia l© 2 0 1 8 C is c o a n d / o r it s a f f ilia t e s . A ll r ig h t s r e s e r v e d . C is c o C o n f id e n t ia l
Agenda
• Operating modes
• Configuration Management
• Authentication
• Deployment Models
• Push Notifications
• Multi-line Operation
• Jabber Bots
• Chromebook Support
UPDATED12.0
NEW12.0
NEW12.0
NEW12.1

© 2 0 1 8 C is c o a n d / o r it s a f f ilia t e s . A ll r ig h t s r e s e r v e d . C is c o C o n f id e n t ia l
Cisco Connect delivers education and
inspiration to technology innovators
worldwide.
cisco.com /go/ciscoconnect
© 2018 Cisco and/or its affiliates. All rights reserved. Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates.
All-in-one UC application for UC Collaborate from any workspace
• Extensive soft phone capabilities
• Voice, video, and voice messaging
• IM, presence and desktop sharing
• VPNless access, Single Sign On
• PC, Mac, tablet, and smartphone
• On-premises and cloud deployment
• Virtualised desktop (VDI)
• Integration with 3rd party productivity tools

Jabber Operating
Modes

worldwide.
New Phone Mode Adds to Existing Options
IM Only Mode Desk phone Control
Soft Phone Mode Soft Phone Mode
(with Contact list)
Soft Phone for
VDI mode
Full UC ModeExtend & Connect
* *
*
Mix different Cisco
Jabber modes
to create your end
user experience
Jabber provides multiple operating modes to meet different customer
requirements.
* Not available on all platforms

worldwide.
Infrastructure Services for Jabber
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
UC Manager
Services
Required Required

worldwide.
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
UC Manager
Services
Required Required
Contact List
Storage
Presence
Service
Instant
Messaging
IM & Presence
Services

worldwide.
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
Contact List
Storage
Presence
Service
Instant
Messaging
UC Manager
Services
IM & Presence
Services
Required Required
IM ONLY MODE

worldwide.
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
Contact List
Storage
Presence
Service
Instant
Messaging
UC Manager
Services
IM & Presence
Services
Required Required
SOFT PHONE
Client ONLY

worldwide.
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
Contact List
Storage
Presence
Service
Instant
Messaging
UC Manager
Services
IM & Presence
Services
Required Required
SOFT PHONE
+ Contact List
NEW in
Jabber
12.0
Enable/Display IM&Presence in Messaging/Presence Settings

worldwide.
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
Contact List
Storage
Presence
Service
Instant
Messaging
UC Manager
Services
IM & Presence
Services
Required Required
FULL Unified
Communications
Mode

worldwide.
Configuring Modes
• Jabber modes should be configured by the server using UDS/TFTP
• For example:
• IM Only mode: (Jabber for everyone)
Enable IM&P, No CTI or CSF/BOT/TAB/TCT devices
• Soft Phone mode:
Don’t enable IM&P, Create CSF/BOT/TAB/TCT devices
• Full UC:
Enable for IM&P, CTI and Create CSF/BOT/TAB/TCT devices
• Avoid Installer switches
• i.e. PRODUCT_MODE=
(also avoid CUP_ADDRESS, CCMCIP, TFTP and CTI settings)

worldwide.
User
Management
Config/Profile
Management
Call Control
SIP
CTI
Control
Contact
resolution (UDS)
Contact List
Storage
Presence
Service
Instant
Messaging
UC Manager
Services
IM & Presence
Services
Other
Services
Jabber 12.0 more flexibility
to use services
Visual
Voicemail
Conference
Bridge
Mobile & Remote
Access
WebEx
Services
Contact
resolution (LDAP)
Required Required

Jabber
Configuration
Manager

worldwide.
Understanding Jabber Configuration Store
• Jabber Clients maintain a local
configuration store
• Store contains service profile,
jabber-config and buddy list
configuration data
• Store is AES-256-CBC with
self-generated
encryption keys
• Keys are stored
in keychain,
keystore, profile
depending on platform On login config & contacts
are restored from
local storage for
fast login experience
1 to 5
m inutes*
* Config then
refreshed for
persistent
connection
every 7~9
hours
Configrefresh
ClientOnline
FAST
Login

worldwide.
Jabber Day Zero Login and Regular Login
Contact List and
client config are
encrypted and
saved locally
On Day 0 client
retrieves config and
contacts
On next login config &
contacts restored from
local storage for
1 to 5
m inutes*
* Config then
refreshed for
persistent
connection
every 7~9
hours
Configrefresh
ClientOnline
Day 0
Login
FAST
Login

worldwide.
Day Zero Service Discovery
• Jabber needs to find its services….
On-Premise Deployment or
Cloud Deployment?
Locate Home Cluster
• Jabber finds services using Service Discovery
• Seed = Service Domain “example.com”
• DNS & REST request used to locate service
• UDS (REST) used to identify home cluster
• Configuration Store can then be populated
On Day 0 client
contacts
Day 0
Login
EM
PTY
DAY 0
LOGIN

worldwide.
How to Find the Service Domain
• The service domain may be identified using the client….
Ask the User Automatic
(Client knew Service domain)
Manual - AVOID!!!
(Don’t discover, I’ll tell you)
DAY 0
LOGIN

worldwide.
Service Domain - Automatic Discovery Methods
If logged into windows domain
then environment variables show UPN
(override w ith UPN _DISCO VERY_EN ABLED)
EMM can push configuration for
mobile clients (iOS/android)
msiexec /i CiscoJabberSetup.msi SERVICES_DOMAIN=example.com
MSI install switches or package
management (SCCM/GP)
ciscojabber://provision?ServicesDomain=example.com
URL Provisioning
DAY 0
LOGIN

worldwide.
Cloud Discovery (WebEx Messenger)
• Jabber will also check if the Jabber domain is enabled for WebEx
Messenger
• Client sends REST request to Cisco WebEx service to check domain
http://loginp.webexconnect.com/cas/FederatedSSO?org=example.com
• If response from cloud indicates the domain is enabled for WebEx
Messenger then client will automatically switch to cloud mode.
• If your organisation is using on-premise mode please contact
WebEx support to disable cloud.
Jabber
Client
WebEx
Messenger
DAY 0
LOGIN

On Premise Discovery
• Jabber will send a DNS request to try and
locate a UC manager cluster to register to.
• Admin must create DNS SRV record(s)
pointing a UC manager node in a cluster
• Discovery can also support multiple clusters
with cluster discovery (discussed later)
Corporate
N etw ork
Jabber
Client
DNS
Server
_cisco-uds._tcp.servicedom ain.com
DN S SRV Request for
UC M anager
DAY 0
LOGIN

Service Discovery – Cluster Discovery
• Once Jabber has a Cisco-UDS server
address from DNS SRV it will connect to
UDS server
• Firstly, it will check the version of UC
Manager
• Secondly it will confirm if this is the
“home cluster” for the jabber user
• If the user is provisioned on the cluster
the server will respond with local server
address
https://host:8443/cucm-uds/version
https://host:8443/cucm-uds/clusterUser?username=asmith
Where is my
home cluster
DAY 0
LOGIN

• In a multi-cluster if the user doesn’t exist on the
queried server a cluster discovery is performed
to known clusters.
• The UDS server will query other clusters
defined in cluster ILS configuration. (UDS REST
is used)
• Users home cluster is defined in end user
configuration
UDS
Request
UDS
Request
Cluster 1
Cluster 2
Cluster 3
DAY 0
LOGIN

Home Sweet
Home!!!
Cluster 1
Cluster 2
Cluster 3
DAY 0
LOGIN
• In a multi-cluster if the user doesn’t
exist on the queried server a cluster
discovery is performed to known
clusters.
• The UDS server will query other
clusters defined in cluster ILS
configuration. (UDS REST is used)
• Users home cluster is defined in end
user configuration

Service Discovery – Home Cluster
• Jabber will request a list of all UDS nodes in the cluster,
randomise the list and connect to a UDS node in home
cluster.
• Jabber will now proceed to download configuration info
from UDS and TFTP services on UC Manager/IM&P
Cluster 2
DAY 0
LOGIN
https://host:8443/cucm-uds/servers
User Profile Service Profile Jabber-config Device List Device Config
< X M L >
Configuration downloaded to local config store
TFTP / IM
Servers LDAP
& VM Feature
Options CSF &
Phones CNF
Files
Contact List
Buddy
List

Jabber Diagnostics will show you all
the UDS REST and TFTP requests the
Jabber client made during service
discovery

Day Zero Login is Complete…….
Contact List and
client config are encrypted
and saved locally
On first login client
contacts
On next login config &
contacts restored from
local storage for
Config and contacts
refreshed from
server after login
User can force
early refresh
using “Refresh
configuration” if
required
1 to 5
m inutes*
* Config then refreshed every 7~9 hours
Configrefresh
Day 0
Login
FAST
Login
FAST
LOGIN

Edge Discovery – Always Performed
Corporate
N etw ork
Jabber
Client
DNS
Server
(internal)
DNS
Server
(external)
Internet
_cisco-uds._tcp.servicedom ain.com
_collab-edge._tcp.servicedom ain.com
Expressw ay Expressw ay
UC M anager
AmI inside
the corporate
network
This DNSrecord ONLY exists
on external DNSserver
Different
Servers
FAST
LOGIN

Secure Communication - Cert Requirements
• Jabber uses secure communications to connect to UC services
• CA signed Certificates must be in place
• Default self-signed certs will generate following error message

Certificate Signing Request
• Certificate management is
performed in OS admin
• “tomcat” certificate is required
for UC manager TFTP/UDS
services
• “cup-xmpp” certificate is
required for XMPP on IM&P
• If using multi-domain then all
domains must be in SAN
• Jabber will check certificate
revocation (both internally and
externally)

Jabber
Authorization

Service Authorization and Authentication
• Jabber must authenticate to services like UDS, XMPP, Unity
and expressway
• Jabber will query UC manager to identify the authorization
method deployed.
• SSO Discovery:
https://cucm:8443/ssosp/ws/public/singleSignOn
• SSO Discovery will return on of 4 responses…..
?

SSO Discovery Responses
• If running UC Manager 9.x,10.x,11.0,(11.5,12.x optional)
1. Username/password no refresh token (UC or LDAP Authentication)
2. SAML-SSO no refresh token (IDP Authentication)
• If running UC Manager 12.0 (incl. 11.5 SU3+)
3. OAuth 2.0 with refresh token (UC or LDAP Authentication)
4. OAuth 2.0 with SAML-SSO and refresh token (IDP Authentication)
When using remote access Expressway can be hardcoded to single
authentication method or can query cluster on users behalf

How Do You Know You’re Using OAuth?
• Once OAuth is enabled Jabber
login screen will change.
• Login screen will not be
presented as webpage from UC
manager

How Does OAuth 2.0 With Refresh Work…..
UC Manager
Authorization
Jabber 11.9
Client
• Jabber discovers New Authorization flow is being
used.
• Authorization Service redirects client to
authentication Service before authorization can take
place.
CUCM
User
LDAP
User
IDP
User
UC Manager
Authentication
Authorized
Users Only
(Token required)
UC Manager
UDS Service
IM&P
Chat Service
Unity Connection
Voicemail

UC Manager
Authorization
CUCM
User
LDAP
User
IDP
User
Jabber 11.9
Client
• Jabber will authenticate with Authentication service.
• Authentication method is dependant on UC
Manager configuration
UC Manager
Authentication
Authorized
Users Only
(Token required)
UC Manager
UDS Service
IM&P
Chat Service
Unity Connection
Voicemail

3
UC Manager
authorization
CUCM
User
LDAP
User
IDP
User
Jabber 11.9
Client
• Authentication service refers
Jabber back to authorization
service
• Access and Refresh tokens
issued
UC Manager
UDS Service
IM&P
Chat Service
Unity Connection
Voicemail

3
UC Manager
UDS Service
IM&P
Chat Service
Unity Connection
Voicemail
UC Manager
authorization
Jabber 11.9
Client
• Once issued Access token used for service access
• All CUCM services, IM&P services trust token
• Unity Connection can also trust CUCM token
CUCM
User
LDAP
User
IDP
User
UC Manager
Authentication

UC Manager
authorization
Jabber 11.9
Client
• Before access token life expires Jabber will
use Refresh token to request new Access
token from OAuth server.No need
To go back to
Authentication
CUCM
User
LDAP
User
IDP
User
UC Manager
Authentication
UC Manager
UDS Service
IM&P
Chat Service
Unity Connection
Voicemail
60
Mins

UC Manager
authorization
CUCM
User
LDAP
User
IDP
User
Jabber 11.9
Client
• When Refresh token expires full authentication
required again
UC Manager
Authentication
Authorized
Users Only
(Token required)
UC Manager
UDS Service
IM&P
Chat Service
Unity Connection
Voicemail
60
Days

Jabber 11.9 OAuth
User Experience
On first login client
requires full
authentication
If access or refresh
token still valid token
is used for
authorization

Turning on OAuth 2.0 with Refresh Token
• OAuth with Refresh Tokens must be enabled on UC manager/IM&P
• On Unity the admin must configure Authz server and then enable in enterprise parameters
• OAuth must also be enabled on expressway if using MRA.

Signature Subject Expiration Scopes
OAuth Under the Hood (Bonnet)
• UC manager Auth
server generates
keys
• Keys pushed or
pulled by UC
infrastructure
components
• Servers use key to
open token and
check content
UCM:OAuth
Server
UCM:UDS
service
UCM:Chat
service
Keys
Unity
Connection
Push
Fetch
Expressway
Summary of token
(contains addition information not shown here)

Mobile Remote Access Policy
• MRA Policy uses OAuth scope to
provide policy
• Policy applied using User Profile
• Policy is defined for desktop and
mobile devices
• Policy defines modalities available
• Requires UC Manager 12.0 and
Expressway X8.10
• Requires OAuth to be enabled

Jabber Deployment
Models

Building Clusters
UC CLUSTER
Single Node: 25,000 Users
Single Cluster: 75,000 Users
Up to 6 Nodes per cluster
deployed in pairs for HA
Single or Multi-domain configuration

More Users = More Clusters
UC CLUSTER UC CLUSTER
Single or Multi-domain configuration Single or Multi-domain configuration

Here is a Different Design…..
VOICE/VIDEO
CLUSTER
VOICE/VIDEO
CLUSTER
NEW in
12.0
(11.5SU4)
1

Here is a Different Design…..
VOICE/VIDEO
CLUSTER
VOICE/VIDEO
CLUSTER
CENTRALISED
IM&P CLUSTER
(N o Telephone Services)
NEW in
12.0
(11.5SU4)
Single node for
User management
1
2

How Does Jabber Connect…..
• Home Cluster remains the Voice Cluster
• Administrator creates IM&P service profile on voice
cluster
which points a centralised IM&P cluster
• Jabber registers to IM&P for presence and chat
Voice/Video
Cluster 1
IM&PCluster
HomeCluster 1
2
NEW in
12.0
(11.5SU4)

How Centralised IM&P Authentication Works…
• Users should exist on both clusters
• OAuth token is used for access with keys
shared from voice/video cluster.
NEW in
12.0
(11.5SU4)

How Centralised IM&P OAuth Works…
UCM:OAuth
Server
UCM:UDS
service
UCM:Chat
service
Keys
Unity
Connection
Push
Fetch
Expressway
Summary of token
(contains addition information not shown here)
Centralised IM&P
Cluster
Trust OAuth
tokens from
Voice/Video
cluster
NEW in
12.0
(11.5SU4)

How Centralised IM&P PUBLISH Trunk Works
• In a regular deploy a
PUBLISH SIP trunk provide
phone presence
Off-hook
Busy
NEW in
12.0
(11.5SU4)

How Centralised IM&P PUBLISH Trunk Works
• In a regular deploy a
PUBLISH SIP trunk provide
phone presence
• Centralised IM&P doesn’t use SIP Trunk model.
Client will switch to client updates for presence
(cloud model)
Off-hook
Busy
Busy Busy
Voice/Video Clusters
Centralised IM&P
Jabber must be
online for off-hook
Presence
NEW in
12.0
(11.5SU4)

Jabber Push
Notifications

Optimised for Mobile
Apple iOS Push Notifications
• Chat and Call notifications routed via
Apple iCloud
• Apple preferred architecture
• Optimised for battery performance
• iOS automatically starts Jabber when
Chat or Call notification received
• Requires UC Manager 11.5.1(SU3)+
Jabber iOS customers should plan to
migrate to push model before June
2018

Push Notifications
iOS Push Notification Flows
Jabber
Process
SIP XM PP
Keep
Alive
UC Manager Node
IM&P /
Messenger
Platform
UC Manager
Node
IM&P /
Messenger
Platform
HTTPS
Apple APNs
Cisco
Collaboration
JABBER in
FOREGROUND
JABBER in
BACKGROUND
Jabber
Process
Incoming
Chat Notification/
Jabber call

Communication with the cloud
UC Manager Connection to Cloud
Direct (via firewall)
Via Proxy server (with auth)
CUCM must be able
to connect Cisco
cloud
These hosts
Fos-a.wbx2.com
push.webexconnect.com
idbroker.webex.com
On this port
TCP/443
Registration creates
a total which is
distributed to all
nodes in cluster
This token allows all
nodes to send APNs
request to Cisco
cloud.

Firewall Considerations
Getting Notifications to iOS Devices
5
• iPhone / iPad will need to be able to
connect to Apple Cloud / APN
service
• iOS devices connect to
17.0.0.0/8 using port 5223/TCP
On Wi-Fi they can fallback to
17.0.0.0/8 using port 443/TCP
iOS devices on
Internet/Expressway
connect directly
Devices on
corporate network
may require ACL

Jabber Multi-Line

Jabber Softphone Multiline Operation
Support on all lines for:
Answer Hang-up Decline Mute UnmuteStart
C all
Forw ard
C all
Transfer
C reate
C onference
Far End
C am era
Share
(BFC P)
History Headset Voicemail
Mobile remote access (MRA) doesn’t support multi-line in this release.
Client will fall back to primary line only on MRA. (Support planned later this
CY)
• Soft Phone support for up to 8 lines
• Full Voice and Video calling
• SIP URI Dialling
• Support on Windows & Mac
C all
Pickup
Hunt
Group
C all
Record
C all
M onitor
C TI
C ontrollable
Hold
NEW in
12.0
(11.5SU3)

Multi-line Softphone UC Manager Requirements
• Jabber Multi-line will require UC manager
CSF device update to support multi line
capability
• A COP file will be provided for customers
to update their UC manager and CSF
device
• Update will be supported on UC Manager
11.5 SU3+.
• UC Manager prior to 11.5 SU3 won’t
support Jabber multi-lineCOP
NEW in
12.0
(11.5SU3)

Multiline Configuration
CUCM > Device > Phone
NEW in
12.0
(11.5SU3)

Unity Connection – Multiline Configuration
• Visual voicemail supports a single mailbox
• Use Unity Connection “Alternative Extension” to
support multiple voicemail from mutli-line
NEW in
12.0
(11.5SU3)

Jabber Bot SDK

The Jabber Bot SDK is used to create
Chat Bots that can interact with users in all sorts of ways
including:
• Providing status and alerts
• Answering Questions
• Asking questions
And based on interaction take an actions…
• Update database
• Starting chat sessions
• Starting Voice & Video sessions
Introducing Jabber Bot SDK
BOTKIT
Framework

• Chat bots created with the Jabber Bot SDK support
Bot Interaction
• One to One user
interaction
• Group Chat and
Persistent Chat
Rooms

Different types of Bots
Alert Bot Interactive Bot Conversation Bot
Simple notification
based on event or
conditions
Simple interaction to
request data or
information
Advanced natural language
interaction where
the intent is determined
to answer question

Alert Bot Example: Financial data
You could use the Jabber bot kit to create a bot to monitor financial data
and send out alerts on changes…..
Chat bot

Alert Bot Example: IoT device
An IOT enabled device could send status and alerts to support staff
using a Jabber Bot SDK application.
Vending
Alert
IOT Enabled
Vending
Bot host

Conversation Bot Example: Meeting Room
With Natural language processing a bot user can use regular
conversational language and the NLP engine is used to identify the ident
of the request.
Example:
IBMWatson
Intent: Meeting
London
2pmtoday
3 people
Video Endpoint
NLP
Natural Language
processor
Bot Host

• For more information on
Jabber Bot SDK
For more information visit Cisco devnet
https://developer.cisco.com/docs/jabber-bots

Cisco Connect Ottawa 2018 jabberv2

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (7)

Similaire à Cisco Connect Ottawa 2018 jabberv2

Similaire à Cisco Connect Ottawa 2018 jabberv2 (20)

Plus de Cisco Canada

Plus de Cisco Canada (20)

Dernier

Dernier (20)

Cisco Connect Ottawa 2018 jabberv2