Below lists the various interfaces that can be configured for Wrangler_ , test_mate, yarn_gate on the common Yarnman Photon Platform.

Cisco Unified Communications Manager

This interface is used by Wrangler_ and test_mate to communicate with multiple services provided by the publisher or subscriber(s).

The following CUCM permissions are required for wrangler_

• Standard CCM End Users

• Standard Admin Users

• Standard CCM Server Monitoring

• Standard AXL API Access

The following CUCM permissions are required for wrangler_ WxC-DI migrations

Before starting the migration, the source and target CUCM, and if required CUC, interfaces must be defined. The minimum Required access roles in the CUCM Application User for the AXL interface are

Source CUCM

WxC-DI (Target) interface

As provided by Cisco with the following proviso if creating/ migrating Custom Access Control Groups in WxC-DI

The following Permissions are required for test_mate

• Standard CCM End Users

• Standard Admin Users

• Standard CTI Enabled

• Standard CCM Server Monitoring

• Standard CTI Allow Control of Phones supporting Rollover Mode

• Standard CTI Allow Control of Phones supporting Connected Xfer and conf

• Standard AXL API Access

Create a new interface in yarnman

• name the interface and press submit

• Bind the interface to the required arm(s)

• Press update/set Credentials

• Type in the ip address of the publisher (this will automatically fill in the details to all the other services)

• Type in the user and password, press use for all interfaces.

• Press submit followed by test connection.

Jade-Berlin

Whilst not technically an interface, this service provide jtapi control and uses the cucm interface within yarnman applications, mainly test_mate.

The jtapi.jar must be downloaded from the cucm.

This is done by navigating to Nodes > clicking on the node name > Pressing (re)download jtapi.jar

Provide the ip address of the publisher, once jtapi.jar has downloaded press restart Jade-Berlin

Common error messages from jtapi

Unable to create provider -- User connected on an invalid port

Most likely Secure CTI permission applied to the application user in cucm, remove secure CTI and only have standard cti

Unable to create provider -- connect timed out

This could be related to firewall or network connectivity between yarnman and cucm, CTI Manager not running on the target node

Unable to create provider -- bad login or password

Most likely wrong username/password/permission on the application user

Unable to create provider -- Incompatible Protocol version

The version of jtapi.jar cached in jade-berlin is not compatible with the target cucm, Download jtapi.jar from target cucm and restart jade-berlin

Unable to create provider -- directory login timeout

Can related to LDAP/AD timeout, high database load on cucm or jtapi not responding

Cisco Unity Connection UCXN Access

Webex API

Webex API uses OAuth2 to provide Access and Permissions to Webex API calls. An integration is created via the Webex developer portal that list the permissions and features (known as scopes in OAuth2). As part of the OAuth2 Process, a Webex User Authorises the integration with their Credentials which create the Tokens, No User/Pass are stored. The integration itself is just a list of permissions and doesn’t have access to Tokens. For more information visit https://developer.webex.com/docs/integrations for an overview.

Add Interface

Login and Navigate to Interfaces > Add Interface

Select Webex API (OAuth2 - Cloud) as the Type

Open

Select Permissions for Interface

Predefined scopes required for each feature, this page will mainly focus on Wrangler_ .

test_mate_CV

This is a predefined list of Webex permissions that is used for Cloud Video testing, with Webex and CVI (Cloud Video Interop) for further details Test_mate Cloud Video

test_mate_WxC

This is predefined list of Webex permissions that is used with Webex Multi Tennant cloud calling, and requires the use of XSI to control phone endpoints registered to Webex. for further details Test_mate Webex Calling Multi Tenant (WxC-MT)

Wrangler_

This is predefined list of Webex permissions that is used with Webex Multi Tennant to read/write changes to an organisation.

This example will show setting up Wrangler_ for Webex Scopes.

Toggle the wrangler_WxC permission and Press Submit

Open

The check Internet Access will verify the Proxy settings can reach webexapis.com, as well as the local browser can reach webex.com for the oAuth authentication flow.

View Permissions required to be set up in Webex integration

When the page saves, press Show Scopes

These are the required roles to be configured on your Webex integration

Create Webex Integration

Open a new Tab/Browser to Create a new Webex integration: https://developer.webex.com/my-apps

Set Webex permissions

Complete the required fields (we will come back to the redirect URI), select or upload a logo, and scroll down to choose the scopes to match the ones shown from Yarnman.

Find Redirect URL from yarnman

Switch back to Yarnman and select the Arm Bindings tab

Select the Yarnman node in the dropdown, followed by pressing Bind to Arm

Save redirect URL in Webex integration.

Copy the URL that is shown as Redirect URL and switch back to Webex

Paste in the URL to the URL field, and make sure to remove any leading Spaces or Tabs that may come through

Save Integration and obtain a Client ID and Secret

Press Add in Webex

Make note of the Client ID, Client Secret ( NOTE: this won't be shown again however it can be regenerated if lost)

Start oAuth flow with Set Credentials

Switch back to Yarnman

Press Update / Set Credentials

Populate

Application with either the same as you called it in Webex or something meaningful.

Client ID as string provided by Webex

Redirect URI as the one supplied by yarnman and press submit

The popup will refresh with an Authorise button with the confirmed details; Press Authorise to obtain the OAuth Token

The Webex authentication screen will be presented. Depending on your environment, this could be handled by Webex or your SSO provider, Such as Microsoft.

Webex will prompt you to allow or deny the permissions associated with your account.

Press accept and log back into yarnman when it redirects

Paste in the Client secret

Token details will be stored.

Test Connection can be pressed to verify that Yarnman can access Webex API by requesting a simple about me API.

Enable Auto Access Token Refresh

From Version 2.6.10 there is a new feature toggle to enable the Access and Refresh token to be auto refreshed every 6days. Toggle this on the settings page of the interface and press Submit

Troubleshooting Scopes

Yarnman can help validate the scopes configured in your Webex app

Copy the whole URL from Webex

Press Validate Scopes in Yarnman

Paste the URL in the popup from Yarnman.

Press validate, and Yarnman will advise the roles that need to be checked on the Webex app

XSI Permission not found

The XSI is a special permission that may not be available on your Webex org, Yarnlab has an integration available for this to provide this function, see the following page for further information about the permissions for test_mate for Webex calling. Test_mate Webex Calling Multi Tenant (WxC-MT)

Contact Yarnlab support to get an integration created https://support.yarnlab.io/ or support@yarnlab.io

Provide Yarnlab with the redirect URL provided on the interface page as per below, This will be unique per interface added and if multiple organisations/interfaces are being tested multiple redirect URLs will need to be provided

Troubleshooting Webex login

Where possible, it's best to use a Private/Incognito session to perform the oAuth flow. There could be issues with cached logins with SSO or the wrong SSO ID being prompted, causing the oAuth to fail with a change of UserID midsession.

Troubleshooting Connectivity

For the OAuth Flow to Work Correctly, the Web browser you use needs to be able to access Webex (the Internet) and Yarnman.

DNS

Below shows the yarnman server is not able to resolve the DNS

Check DNS servers used by the yarnman server (do not edit this file)

to change the DNS servers, in this example, we are replacing the single DNS server with multiple DNS servers

You must first log in as the root user to modify system settings using su. exit out from the root when you are done

Test to validate yarnman can reach webexapis.com, note 401 error as we are trying to browse without any credentials

Test Direct Access

Proxy

Depending on your environment, yarnman may also need to be able to resolve the proxy if a FQDN is required to the proxy server

You can verify yarnman can reach the proxy using curl, the http1.1 200 connection established shows the connection to the proxy was successful

Proxy without Auth

Proxy showing user/pass is required

Proxy server requires a user/pass to connect, with the 407 error

Proxy showing user/pass to the proxy

the first 407 tells curl to try again with user:pass, 200 connect is successful to the proxy followed by the 401 to webex as expected.

MSGraph

This is used to access o365 calendaring information for test_mate Cloud Video. This also uses OAuthv2, but more in a API key method

a ClientID and ClientSecret are required, which are provisioned in Microsoft Entra ID (formerly Azure Active Directory) with the required permissions and access. The API key will expire after a period of time, usually 180days (this depends on the customers security policy)

Select the Microsoft Graph API as the interface type, Configure a Proxy if required in the environment. Bind the Arm to the yarnman server.

Press Update/Set credentials enter in the AppID, AppKey and default microsoft TenantID

Pressing Test connection will return a list of users if successful

PRTG

Currently used with yarn_gate to allow a HTTP push to Paessler PRTG for scheduled tasks results.

Select PRTG as the interface type, provide a description and the HTTP/S PRTG Sensor Address.

Click on Arm bindings to bind this to a yarnman server(s)