We have a brand new deployment going on, where our University has purchased WebEx MeetingPlace. We have the Cisco CallManager component working, but the integration with Single Sign On with ADFS 2.0 has been nothing short of torture. The biggest problem I'm working with is that we use Split-Brain DNS, and our internal domain name versus external domain name is different. Trying to determine what credentials are getting passed back and forth, certificate errors for using the self-signed certificate, etc.

Does anyone have any experience with this, or something similar? Do you have any tips, or watch-out-for-this, etc.? I've not worked with a Federated Authentication system before, and this scenario is very black-box-esque. Sorry, I'm also partially ranting as I'm frustrated.


Yes! I went through this torture a few months ago. There is a secret (well not really secret, but not easy to find) integration guide that is pretty much step-by-step. Find it here: https://support.webex.com/MyAccountWeb/knowledgeBase.do?root=Tools&parent=Knowledge&articleId=WBX63102

The best place to ask questions about this if you are having random issues is the developer community board, here: http://developer.cisco.com/web/webex-developer/forum/-/message_boards/category/4828392

| improve this answer | |
  • I appreciate your response, I've actually received this document. My problem is that it doesn't cover not using self-signed certificates, and we're running split-brain DNS, which causes problems between the SAML assertion and things like server URLs. I will, however, check out that message board, the Cisco folks tend to help me much more than my CSR. – DavisTasar Oct 18 '12 at 0:53
  • We are also using real certs and split DNS, what issues are you having? – smithian Oct 18 '12 at 6:14
  • Windows machines bound to our Active Directory domain are unable to authenticate, however, Linux boxes, Macs, and Non-Bound Windows boxes can authenticate. Edit: I should add that we're using the same credentials across all machines, and that they all reach the ADFS server and I can see their failed/success attempts in the Security Log. – DavisTasar Oct 18 '12 at 12:37
  • Sounds like you need to add an additional item to your AuthnContextClassRef value in the webex portal. You can add more than one in the field, semicolon-delimited. what does your AuthnContextClassRef value look like? – smithian Oct 18 '12 at 13:05
  • The value I have in the WebEx portal is: "urn:federation:authentication:windows" I sincerely appreciate this assistance. It's been a very trying time, and to have someone say, "Oh, it sounds like this" is just very helpful. – DavisTasar Oct 18 '12 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.