Configuring token-based access between Avaya Control Manager and Avaya Workspaces for Call Center Elite

Last Updated : May 15, 2025 |
Prolog information
Metadata
Keywords:
Avaya Workspaces for Call Center Elite requires configuration of token-based access to UCA REST APIs. After the configuration has been done, all REST requests must contain a valid token within the request header or the requests are rejected. Token-based access affects Avaya Control Manager management of the Avaya Workspaces for Call Center Elite solution and agent logins.
Token enforcement requires that the client of the REST API first requests a token from the Avaya Breeze® platform Authorization Service. The client sends a digitally-signed token request to the service with a list of objects that it wants to access. If the Authorization Service recognizes the client and grants access to the resource, the service returns a signed token. The client uses this token in subsequent calls to the target REST service. The service endpoint checks the validity of the token on each request and processes a request only if the token is valid.
For token-based access to work, perform the following procedures:
  • Install signed certificates on the Avaya Control Manager deployment.
  • Install the root certificate from the Avaya Breeze® platform cluster hosting the Authorization service as a trusted root certificate authority on the Avaya Control Manager application server.
  • Import the Avaya Control Manager public certificate into the Authorization clients list so that the Authorization service recognizes token requests from the Avaya Control Manager server.
  • Assign Grants to the Avaya Control Manager client to define the list of resources that can access the Avaya Control Manager server.
  • Enable token-based access in Avaya Control Manager.
  • Configure the Avaya Breeze® platform assigned Client ID for Avaya Control Manager in Avaya Control Manager.
  • For more information, please refer Configuring Avaya Control Manager documentation available on the Avaya Support website at https://support.avaya.com
Before you begin
  • Ensure that signed certificates are installed on the Avaya Control Manager deployment. For information about certificate installation, see the Avaya Control Manager installation and upgrade documents.
  • On the System Manager web console, click ServicesInventoryManage Elements and identify the root CA that was used to sign the certificate for one of the nodes in the Avaya Breeze® platform cluster that hosts the Authorization service.
  1. Create trust between Avaya Control Manager and the Authorization Service
  2. Log on to Windows on the Avaya Control Manager server where you must install certificates.
  3. Click StartRun.
  4. In the Run dialog box, type mmc and click OK.
    STEP RESULT:
    The system displays the Microsoft Management Console.
  5. Click FileAdd/Remove Snap-in.
  6. On the Add or Remove Snap-ins window, in Available snap-ins, select Certificates.
  7. Click Add >.
  8. On the Certificates snap-in window, select Computer account.
  9. Click Next.
  10. On the Select Computer window, select Local computer.
  11. Click Finish.
  12. Click OK.
  13. Expand the Certificates folder.
  14. Click Trusted Root Certification AuthoritiesAll TasksImport.
    STEP RESULT:
    The system displays the Certificate Import Wizard Welcome screen.
  15. Click Next.
    STEP RESULT:
    The system displays the File to Import screen.
  16. Click Browse to locate the root certificate you requested from the CA.
  17. Click Next.
  18. Select Place all certificates in the following store.
  19. Click Browse and select Trusted Root Certification Authorities.
  20. Click Next.
  21. Click Finish.
  22. Try accessing the Authorization URL from a browser using the following URL
    ADDITIONAL INFORMATION:
    https://WorkspacesForEliteClusterFQDN:9443/services/AuthorizationService/token
    STEP RESULT:
    Ensure that the link appears as secure in the browser. If you see Error 401, ignore it.
  23. Add the Authorization client to System Manager
  24. Log on to System Manager.
  25. Navigate to ElementsAvaya Breeze®ConfigurationAuthorization.
  26. On the Authorization Configuration page, click New.
  27. On the New External Authorization Client page, do the following:
    1. In the Name field, enter the name of the Avaya Control Manager server.
    2. In the Certificate field, browse to the certificate containing the public key that was exported from the Avaya Control Manager certificate manager.
    3. Click Commit.
      STEP RESULT:
      The new client now appears in the list of authorized clients.
  28. Add Grants to the Avaya Control Manager application
  29. On the Authorization Configuration page, select the Avaya Control Manager client that you added to System Manager.
  30. Click Edit Grants.
  31. On the Edit Grants for Authorization Client page, click New.
  32. On the Create Grant for Authorization Client page, do the following:
    1. In the Resource Name field, select UCAStoreService.
    2. In the Resource Cluster field, select the Avaya Workspaces for Call Center Elite cluster that hosts UCAStoreService.
    3. In the Feature field, select ACM.
    4. In the Values field, select the delete, read, and write check boxes.
  33. Click Commit.
  34. Click Done.
  35. On the Authorization Configuration page, do the following:
    1. In the Name column, locate the entry for the Avaya Control Manager client.
    2. In the Id column, locate the ID value for the Avaya Control Manager client and make a note of the ID value.
      ADDITIONAL INFORMATION:
      You must use the exact ID value when configuring the Avaya Control Manager identity.
  36. Add Grants to the Authorization Service
  37. Navigate to ElementsAvaya Breeze®ConfigurationAuthorization.
  38. Select AuthorizationService from the list of clients.
  39. Click Edit Grants.
  40. Click New.
  41. On the Create Grant for Authorization Client page, do the following:
    1. In the Resource Name field, select UCAStoreService.
    2. In the Resource Cluster field, select the Avaya Workspaces for Call Center Elite cluster.
    3. In the Feature field, select UserAuthentication.
    4. In the Values field, select the read check box.
  42. Click Commit.
  43. Click Done.
  44. Configuring the Avaya Control Manager identity
    Before you begin
    Ensure that you have the ID value of the Control Manager client noted from the Authorization Configuration page of System Manager.
    Procedure:
    1. On the Control Manager server, go to C Drive Windows System32 and open the Nav360Config.xml file in the edit mode.
    2. Search for clientId line and insert the client ID that you noted from the Authorization Configuration page of System Manager in following format:
      <clientId alias="<SystemType-ServerAliasNameInACM>"> </clientId>
      For example:
      <clientId alias="<Oceana-OceanaAlias>">hgWDUFOQPa38trefi8DjmoA</clientId>
      <clientId alias="<WSfE-EliteAlias>">gNVUFWmTAaeToCIXgWQeQ</clientId>
      <clientId alias="<Analytics-AnalyticsAlias>">hgWDUFOQPa38trefi8DjmoA</clientId>
    3. Save and close the Nav360Config.xml file.
    4. Restart the Control Manager.
  45. Log on to Avaya Control Manager.
  46. Navigate to ConfigurationCustomer EngagementWorkspaces for Elite.
  47. Double-click the Avaya Workspaces for Call Center Elite server in the list.
  48. On the Connection Details tab, do the following:
    1. Select the Enable Authorization check box.
    2. In the Authorization Service URL field, enter the following value:
      ADDITIONAL INFORMATION:
      https://WorkspacesForEliteClusterFQDN:9443/services/AuthorizationService/token
    3. In the Breeze Alias field, select the Breeze instance alias.
  49. Click Save.
  50. Enable token enforcement in UCA
  51. In System Manager, click ElementsAvaya Breeze®Configuration Attributes.
  52. On the Service Clusters tab, do the following:
    1. In the Cluster field, select the Avaya Workspaces for Call Center Elite cluster.
    2. In the Service field, select UCAStoreService.
    3. In the Advanced group, set the Enable Tokenless Access attribute to FALSE.
    4. Click Commit.