innovaphone wiki - User contributions [en]

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-23T07:37:43Z

Univention:

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* UCS 5.2-4 errata298

* innovaphone PBX V16r1

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png|700px]]

==== Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png|700px]]

==== Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png|700px]]

==== Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png|700px]]

==== Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''

[[{{ns:file}}:LDAP_Übersicht.png|700px]]

''(Screenshot: innovaphone LDAP replicator)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator.png|700px]]

==== Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator_02.png|700px]]

==== Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T12:07:16Z

Univention: /* Version */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* UCS 5.2

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png|700px]]

==== Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png|700px]]

==== Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png|700px]]

==== Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png|700px]]

==== Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''

[[{{ns:file}}:LDAP_Übersicht.png|700px]]

''(Screenshot: innovaphone LDAP replicator)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator.png|700px]]

==== Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator_02.png|700px]]

==== Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T12:05:45Z

Univention:

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png|700px]]

==== Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png|700px]]

==== Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png|700px]]

==== Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png|700px]]

==== Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''

[[{{ns:file}}:LDAP_Übersicht.png|700px]]

''(Screenshot: innovaphone LDAP replicator)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator.png|700px]]

==== Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator_02.png|700px]]

==== Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T12:03:57Z

Univention:

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png|700px]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png|700px]]

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png|700px]]

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png|700px]]

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''

[[{{ns:file}}:LDAP_Übersicht.png|700px]]

''(Screenshot: innovaphone LDAP replicator)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator.png|700px]]

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator_02.png|700px]]

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T12:03:15Z

Univention: /* 5. Configuring the LDAP Replicator in the innovaphone Environment */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png]]

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png]]

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png]]

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''

[[{{ns:file}}:LDAP_Übersicht.png|700px]]

''(Screenshot: innovaphone LDAP replicator)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator.png|700px]]

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator_02.png]]

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T12:00:37Z

Univention: /* 5. Configuring the LDAP Replicator in the innovaphone Environment */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png]]

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png]]

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png]]

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''

[[{{ns:file}}:LDAP_Übersicht.png]]

''(Screenshot: innovaphone LDAP replicator)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator.png]]

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

[[{{ns:file}}:Innovaphone_LDAP_Replikator_02.png]]

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

File:Innovaphone LDAP Replikator 02.png

2026-03-05T11:58:11Z

Univention:

Innovaphone LDAP Replikator 02

File:Innovaphone LDAP Replikator.png

2026-03-05T11:57:52Z

Univention:

Innovaphone LDAP Replikator

File:LDAP Übersicht.png

2026-03-05T11:57:26Z

Univention:

LDAP Übersicht

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T11:56:49Z

Univention: /* 4. Verifying LDAP Attributes */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png]]

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png]]

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_03.png]]

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''
''(Screenshot: innovaphone LDAP replicator)''

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

File:Benutzer bearbeiten erstellen 03.png

2026-03-05T11:56:17Z

Univention:

Benutzer bearbeiten erstellen 03

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T11:55:31Z

Univention: /* 3. Assigning a Phone Number to the User */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png]]

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen_02.png]]

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''
''(Screenshot: innovaphone LDAP replicator)''

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

File:Benutzer bearbeiten erstellen 02.png

2026-03-05T11:54:48Z

Univention:

Benutzer bearbeiten erstellen 02

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T11:54:10Z

Univention: /* 2. Creating a Sample User in UCS */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

[[{{ns:file}}:Benutzer_bearbeiten_erstellen.png]]

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''
''(Screenshot: innovaphone LDAP replicator)''

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

File:Benutzer bearbeiten erstellen.png

2026-03-05T11:52:03Z

Univention:

Benutzer bearbeiten erstellen

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T11:51:20Z

Univention: /* Configuration */

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

[[{{ns:file}}:Benutzer_für_die_LDAP_Replikation_erstellen.png]]

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''
''(Screenshot: innovaphone LDAP replicator)''

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

File:Benutzer für die LDAP Replikation erstellen.png

2026-03-05T11:49:19Z

Univention:

Benutzer für die LDAP Replikation erstellen

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-03-05T11:48:28Z

Univention:

[[Image:CompanyLogo.png||200px|right]]

==Product Name==


Univention GmbH [https://www.univention.com/products/ucs/ Univention Corporate Server (UCS)]

==Certification Status==




==Category==





==Vendor==



Univention is a provider of open-source solutions for identity and access management (IAM) and the integration of IT applications.

[[{{ns:file}}:Univention-Logo.png]]

==Description==



Univention Corporate Server (UCS) is an open integration platform that, together with Univention Nubus, provides centralized identity and access management with a web portal for easy access to applications and enables the management of heterogeneous IT domains through comprehensive Active Directory functionality.

[[{{ns:file}}:UCS_Logo.png]]

==Functions==


* Portal with single sign-on
* Integrated identity and access management
* Packaged integrations
* App Center with enterprise applications
* Active Directory integration
* Platform for the entire IT infrastructure
* Deployment on-premises, in the cloud, or hybrid

==Version==




Product versions used for interop testing:

* 3rd-Pty-Product Version

* innovaphone V12r2sr24

==Configuration==






=== LDAP Integration of UCS with the innovaphone Environment including SSO via Keycloak ===

This article describes how an '''LDAP integration between Univention Corporate Server (UCS)''' and an '''innovaphone PBX environment''' can be implemented.

The configuration shown below has been successfully tested and demonstrates how user accounts from UCS can be synchronized into the innovaphone environment using '''LDAP replication'''.

In addition, the article explains how '''telephony features can be accessed via Single Sign-On (SSO)''' using '''Keycloak''' as an identity provider.

The following step-by-step guide outlines the complete setup process. Each step is supported by corresponding screenshots.

=== Step-by-Step Guide ===

==== 1. Creating an LDAP Service Account for Replication ====

First, a dedicated user account is created in '''UCS''' that will be used exclusively for accessing the LDAP directory during the replication process.

This account allows the innovaphone system to retrieve the required user information from the UCS LDAP directory.
In this example, the username '''“ldapread”''' is used.

The account only requires '''read permissions for the LDAP directory''', so no elevated privileges are necessary.

''(Screenshot: Create user for LDAP replication)''

==== 2. Creating a Sample User in UCS ====

In the next step, a regular user account is created in the UCS system. This user will later be replicated to the innovaphone environment via LDAP.

For demonstration purposes, the example user '''Max Muster''' is created.

''(Screenshot: Create user)''

==== 3. Assigning a Phone Number to the User ====

To enable telephony functionality for the user within the innovaphone environment, a '''phone number (extension)''' must be assigned in UCS.

In this example, the user is assigned the extension '''100'''.

This information is stored in the LDAP directory and can later be imported and mapped within the innovaphone environment.

''(Screenshot: Edit user)''

==== 4. Verifying LDAP Attributes ====

The configured LDAP attributes in UCS can be inspected using the '''LDAP administration interface (LDAPAdmin)'''.

This interface allows administrators to review all available LDAP attributes associated with a user account. These attributes are later accessed and processed by the innovaphone LDAP replicator.

This view is particularly useful for identifying which attributes should be used for '''mapping between LDAP source attributes and innovaphone target attributes'''.

''(Screenshot: User overview in LDAPAdmin)''

==== 5. Configuring the LDAP Replicator in the innovaphone Environment ====

Next, the LDAP replicator is configured within the innovaphone environment.

The following parameters must be defined:
* Connection to the '''UCS LDAP server'''
* Authentication using the previously created '''service account “ldapread”'''
* Definition of the '''LDAP search base'''
* Configuration of the '''attribute mapping between LDAP source attributes and innovaphone target attributes'''

This mapping ensures that information such as:
* Username
* Phone number
* Display name

is correctly transferred from the UCS LDAP directory to the corresponding attributes in the innovaphone platform.

''(Screenshot: LDAP overview)''
''(Screenshot: innovaphone LDAP replicator)''

==== 6. Synchronization and Provisioning of the User Account ====

After the LDAP replicator has been configured successfully, user data from the UCS LDAP directory is synchronized with the innovaphone environment.

During this process, the previously created user '''Max Muster''' is automatically provisioned as a user account within the innovaphone platform.

Once the synchronization is complete, the user becomes available for telephony services within the PBX system.

''(Screenshot: User account in the innovaphone environment)''

==== 7. Configuring Single Sign-On (SSO) via Keycloak ====

Finally, '''Keycloak''' is integrated as the identity provider to enable '''Single Sign-On (SSO)'''.

The configuration is performed according to the official innovaphone documentation:

https://wiki.innovaphone.com/index.php?title=Howto14r1:Single_Sign_On_-_oAuth_Login_with_KeyCloak#Steps_in_innovaphone_PBX

Keycloak is configured to use the identities managed in UCS and provides authentication services for the innovaphone environment.

With this setup, users can authenticate '''once via Keycloak''' and then seamlessly access the innovaphone platform and its telephony features.

User identities and related attributes are automatically '''provisioned from UCS''', allowing them to be used for authentication and authorization within the SSO workflow.

As a result, '''telephony services via Single Sign-On are fully configured and ready for use'''.

==Contact==



{|
| Univention GmbH
|-
| Mary-Somerville-Str. 1
|-
| 28359 Bremen
|-
| Tel: +49 (0)421 22232-0
|-
| Web: https://www.univention.com/
|-
| Mail: [mailto:info@univention.de info@univention.de]
|}

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-27T08:58:31Z

Univention:

File:UCS Logo.png

2026-02-27T08:44:29Z

Univention:

UCS Logo

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-27T08:39:09Z

Univention: /* Vendor */

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-27T08:38:26Z

Univention: Vendor

File:Univention-Logo.png

2026-02-27T08:34:41Z

Univention: Univention uploaded a new version of File:Univention-Logo.png

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-23T14:32:35Z

Univention: /* Contact */

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-23T14:32:14Z

Univention: /* Contact */

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-23T14:31:03Z

Univention: /* Contact */

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-23T14:25:15Z

Univention: /* Product Name */

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-23T14:22:53Z

Univention: /* Vendor */

File:Univention-Logo.png

2026-02-23T14:15:27Z

Univention:

Howto:Univention Corporate Server (UCS) - Univention GmbH - 3rd Party Product

2026-02-23T14:09:33Z

Univention: Insert structure