Logging In With External Identity Providers

In addition to the username/password sign-in, several other login options are available in CommPeak Dialer and Cloud PBX. You can choose the best methods for meeting your needs. All options provide secure ways for verifying the user's identity.

• Login with GoogleOAuth
• Login with MicrosoftOAuth

Both options above follow the OAuth 2.0 standard for secure authorization, enabling delegated access by issuing access tokens to third-party services without exposing user credentials. However, OAuth is solely for authorization — not authentication.

The OpenID Connect (OIDC) authentication layer is built on top of OAuth 2.0. Identity providers use OIDC so users can first sign in with their Identity Provider (IdP) and then access applications without having to log in and share credentials.

OAuth lacks encryption and relies on secure socket layer and transport layer security protocols (SSL/TLS), making it generally not a good choice for securing an enterprise with hundreds or thousands of employees.

• Login with SSO SAML only

The CommPeak Dialer and Cloud PBX, supports Single Sign-On (SSO)-only mode, allowing users to log in without entering a username or password. For details on enabling SSO-only login, click here.

❗️

IMPORTANT

Ensure SSO is working properly before enabling it as the sole login method. If SSO fails, the user may be locked out and need to contact support for assistance.

📘

Undestanding SAML benefits

Managing passwords for applications used by hundreds or even thousands of employees can be extremely challenging. Security Assertion Markup Language (SAML) offers enterprises a single sign-on protocol.

SAML is a protocol that lets an IdP transmit a user's credentials to a service provider to both authenticate and authorize that user to access a service. SAML simplifies password management and enables SSO. It is helpful for enterprises because employees have access to more applications to carry out their jobs.

When a user requests access to the Dialer or Cloud PBX, it redirects the user to an IdP for authentication, which could be a service like GSuite or Okta. The IdP then verifies the user's identity, typically through methods like passwords or biometrics, and generates a SAML assertion response containing the user's authenticated identity. This SAML assertion response is sent back to the Dialer or Cloud PBX, which grants the user access based on the identity information provided in the response.

How to turn on Google OAuth

To turn on the login with Google OAuth for your users:

1. Go to Settings > General Settings.

2. Scroll down to the Login Configuration section.

3. Toggle the slider to the right to enable the relevant option.

   

📘

NOTE

Please take into account the following information:

1. This login option is available to all users with a Google email account.
2. When a user logs in with Google and authorizes their Google email, the Dialer or Cloud PBX system searches for this email address in its database. The login is then associated with the first user account that matches the authorized Google email.
3. If the system contains the same email address for more than one user, the login will be assigned to the first active user with that email.
4. Sign-in from a standalone CommPeak Softphone doesn't support the Google login.
5. This login feature bypasses both the login with email one-time code and two-factor authentication processes.

How to turn on Microsoft OAuth

To turn on the login with Microsoft OAuth for your users:

1. Go to Settings > General Settings.

2. Scroll down to the Login Configuration section.

3. Toggle the slider to the right to enable the relevant option.

   

📘

NOTE

Please take into account the following information.

1. This login is available to any user utilizing Microsoft or Azure Email services, including Microsoft 365, and Live accounts.
2. When a user logs in with Microsoft after authorizing their Microsoft email, the system searches for this email in the Dialer or Cloud PBX. The login is then assigned to the first user associated with the authorized Microsoft email.
3. If the system contains the same email address for more than one user, the login will be assigned to the first active user with that email.
4. This login option bypasses both the login with email one-time code and two-factor authentication processes.

How to integrate with a SAML provider

To integrate:

1. Go to Settings > General Settings.

2. Scroll down to the Login Configuration section.

3. Enable the account login with SSO SAML by inserting SAML Login URL, which must be obtained from your IdP. The Issuer URL and ACS URL are shown below the login URL.

   

📘

NOTE

Please take into account the following information:

1. SAML login lets you easily manage which users within your organization can access the Dialer or Cloud PBX. Users do not need to enter passwords; they simply click Login via SSO and authenticate through the customer's SAML IdP.
2. Sign-in from the standalone CommPeak Softphone doesn't support the Login with SSO option.
3. The system processes the email authorized by the customer’s SAML provider and logs in with the same active user email in the system. Deleted or inactive users cannot log in using SAML.
4. This login option bypasses both the login with email one-time code and two-factor authentication processes.

SAML setting examples

Okta

Please visit Okta help instructions.

1. Create an integration.

   

2. Insert the Dialer or Cloud PBX account access URL and issuer URL.

   

3. Advanced settings.
   Make sure to set "Response", "Assertion Signiture" to Signed , "Assertion Encryption" to "Unencrypted", Signature Algorithm to "RSA-SHA256",
   SAML Issuer ID is your issues URL from your Dialer.

4. Attributes setup:

   

5. Now, you can assign users in your organization to sign in via the Dialer or Cloud PBX SAML login.

6. Go to Sign on tab, use the Sign On URL inside your Dialer setup SAML settings.

   

7. Go to Sign on tab, use the SAML Signing Certificates section:
   On the active certificate row → Actions → Download certificate.
   Open the file in a text editor, copy the contents, paste into your Dialer field "SAML identity provider certificate".

   

Google

Please visit Google help instructions.

1. Click Add custom SAML app.

   

2. Enter CommPeak Dialer, then click CONTINUE.

   

3. Copy the SSO URL to the Dialer SAML IDP Login URL.
   Copy Certificate to the Dialer SAML identity provider certificate

   

4. Insert the Dialer issuer URL and ACS URL here.

   

5. After the setup is complete, you can test the login. Click TEST SAML LOGIN and proceed.

   

Microsoft Azure

1. In portal.azure.com find "Enterprise Applications"

2. Click on "New application" in the top bar

3. Search for “Microsoft Entra SAML Toolkit”, click on it, and install it by pressing the “Create” button in the right sidebar.

4. In the left pane, find "Properties" under "Manage", and set "Assignment Required" to "No". (This step might not be required, but assignment to groups and users must be defined instead)

5. Go to “Single sign-on” in the left pane under "Manage" and select "SAML"

6. In "Basic SAML Configuration" define the following (replace dialer domain with the correct one):

   1. Identifier (Entity ID):

      <https://{account_name}.td.commpeak.com/auth/saml-metadata>

   2. Reply URL (Assertion Consumer Service URL):

      <https://{account_name}.td.commpeak.com/auth/saml-acs>

   3. Sign on URL:

      <https://{account_name}.td.commpeak.com/auth/saml>

7. Download your SAML Certificates:
   Microsoft Entra admin center → Entra ID → Enterprise applications → Your app name → Single sign-on, then the SAML Certificates section (step 3 on that page):
   

   

   
   Download : Certificate (Base64) downloads a text file, open it in a text editor and copy the contents into Dialer field "SAML identity provider certificate".

8. Edit "Attributes & Claims" and verify "Required claim" configuration to have:

   1. Name identifier format - Email address
   2. Source attribute - user.mail

8. Edit “Advanced SAML claims options” under “Advanced settings” and check the following checkboxes:
   1. Include attribute name format
   2. Append application ID to issuer

9. From “Set up Microsoft Entra SAML Toolkit” copy “Login URL” and place it in Tenant Settigns in Dialer as SAML Login URL

10. Your SAML Login LDP URL on dialer should looks like

https://login.microsoftonline.com/{azure_app_id}/saml2

For more info, please visit Microsoft Azure help instructions page.

SAML login error messages

When a Login via SSO attempt fails, the Dialer or Cloud PBX returns the user to the login page with a message that names the cause. Each message ends with a six-character reference, for example (Reference 589D4D). The message describes the identity provider configuration only. It never shows anything from the user's identity or from the IdP response.

📘

NOTE

Most of these messages point to a setting in your IdP application, not in the Dialer. Compare the message with the matching setting in the SAML Setting Examples for your provider. If the fix isn't clear, send the reference code to our support team: it identifies the exact failed attempt and what your IdP sent.