/mcpSingle Sign-On API Errors Description Error Type Status The user attempted to run the API against the secondary Finesse server. Configuration APIs cannot be run against the secondary Finesse server. Forbidden 403 Client Integration Clients can use the Finesse REST APIs in SSO mode. For thick client integrations, the following are browser like behaviors that thick clients must ensure to exhibit: • Follow server issued redirects. • Store and forward cookies. • Honor the various cookie attributes. • Run JavaScript in HTML responses. Procedure Step 1 Use the API to get the system's authentication mode. The authentication mode can be found in the response as the value of the systemAuthMode. If the system's authentication mode is SSO, then you can skip step 2. Note Step 2 Use the Single Sign-On—Get User Authentication Mode to get a specific user's authentication mode. You must use browser components that allow redirections and IdP form submissions. You cannot use Postman or AJAX for the Single Sign-On APIs. Note Step 3 Use the Single Sign-On—Get User Authentication Mode with the return_user query parameter set to yes to get the user's access token. The username must be provided in a cookie or a URL query parameter with a key of cc_username. The value is a URL encoded username, which can be the loginName or peripheralId for whom the token is requested. Example: https://finesse1.xyz.com/desktop/sso/token?return_refresh_token=true The result of the API request will redirect the request to the IdS page which then redirects to the IdP page. Step 4 On the IdP page, enter the username and the password. • On successful authentication, the response body contains the access token and user_id value. The access token returns the token in the JWT format. Example Response: Cisco Finesse Web Services Developer and JavaScript Guide, Release 12.5(1) 196 Cisco Finesse Desktop APIs Single Sign-On API Errors