500-444 Exam Dumps : Cisco Contact Center Enterprise Implementation and Troubleshooting

 = In order to configure SAML SSO for PCCE, you need to create claim rules that specify the claims sent from ADFS to Cisco Identity Service as part of a successful SAML assertion. The claim rules define how to transform the incoming claims from the AD FS identity provider into the outgoing claims that are expected by the Cisco Identity Service relying party. The two claim rules that are required for PCCE are:

• sAMAccountName - Logon names maintained for backward compatibility. This claim rule maps the sAMAccountName attribute from the AD FS identity provider to the uid attribute in the outgoing claim. The uid attribute is used to identify the authenticated user in the claim sent to the applications. The sAMAccountName attribute is the logon name used to support clients and servers from a previous version of Windows1.
• E-Mail Address - For the Outgoing claim type. This claim rule maps the E-Mail-Addresses attribute from the AD FS identity provider to the mail attribute in the outgoing claim. The mail attribute is used to provide the email address of the authenticated user in the claim sent to the applications. The E-Mail-Addresses attribute is the primary email address of the user2.

The other options are not valid claim rules for PCCE. The user_principal option is not a valid attribute name in AD FS. The Unspecified option is not a valid claim type in AD FS. The uid option is not a valid attribute name in AD FS, but it is the outgoing claim type that is mapped from the sAMAccountName attribute.

References :=

• AD FS 2.0 Setup for SAML SSO Configuration Example
• Configure Single Sign-On with CUCM and AD FS 2.0
• Checklist - Creating Claim Rules for a Claims Provider Trust
• Notes on ADFS as SAML IdP for ISE User Portals

n Contact Center Enterprise with Cisco Unified Customer Voice Portal (CVP) and Cisco Unified Border Element (CUBE) deployment, CUBE must be configured as media pass flow-through mode. This means that CUBE will terminate and reoriginate both the signaling and media streams for each call leg. This allows CUBE to perform media manipulation, such as transcoding, transrating, DTMF interworking, and media forking. Media pass flow-through mode is required for CUBE to support advanced features for contact center, such as courtesy call back, contact center survivability, and encrypted (SRTP) trunks. Media pass flow-around mode, where CUBE only terminates and reoriginate the signaling stream and lets the media stream bypass CUBE, is not supported for contact center solutions. A voice gateway must not be dedicated for VXML browser sessions, as CUBE can coexist with VXML gateway on the same platform. Box-to-box CUBE can be used for redundancy, but it is not a mandatory configuration for contact center solutions123. References:

• Cisco Unified Border Element Configuration Guide - Cisco IOS XE 17.6 Onwards - Advanced Features for Cisco Contact Center2
• Cisco Unified Border Element (Enterprise) Fundamentals and Basic Setup4
• Cisco Unified Border Element for Contact Center Solutions5

According to the Cisco documentation12, single sign-on (SSO) in PCCE can be implemented in one of these three modes:

• SSO - Enable all agents and supervisors in the deployment for SSO. This mode requires the use of SAML assertions to exchange authentication and authorization details between an identity provider (IdP) and an identity service (IdS)1.
• SAML - Security Assertion Markup Language (SAML) is an XML-based standard that allows the IdP to issue SAML assertions, which are packages of security information transferred from the IdP to the service provider for user authentication1. SAML is the underlying technology that enables SSO in PCCE2.
• Hybrid - Enable agents and supervisors selectively in the deployment for SSO. Hybrid mode allows you to phase in the migration of agents from a non-SSO deployment to an SSO deployment and enable SSO for local PGs. Hybrid mode is useful if you have third-party applications that don’t support SSO, and some agents and supervisors must be SSO-disabled to sign in to those applications1.

Option A is incorrect because Non-SSO is the opposite of SSO, and it means continuing to use existing Active Directory-based and local authentication, without SSO1. Option C is incorrect because ldS is a typo for IdS, which is not a mode but a component of SSO. Option D is incorrect because ldP is a typo for IdP, which is also not a mode but a component of SSO.

References:

• 1: Single Sign-On - Cisco3
• 2: Cisco Packaged Contact Center Enterprise Features Guide Release 11.6 (1) - Single Sign-On [Cisco Packaged Contact Center Enterprise] - Cisco

• SSO - Enable all agents and supervisors in the deployment for SSO.
• Hybrid - Enable agents and supervisors selectively in the deployment for SSO. ...
• Non-SSO - Continue to use existing Active Directory-based and local authentication, without SSO.