V20 Windows App provisioning

[BALangford]

Im just wondering, is there any support/documentation on setting up auto provisioning or SSO within the new desktop app?

When pushing the PWA it was nice that users just had to click the Microsoft button to sign in. Easy, clean, fast. Now having to explain to them the URL to enter into the app, then click M365, then the Microsoft button in the browser window that opens, then click the provision button in the popup is tedious enough that I expect most of my users to never do it or need hand holding for the process.

If nothing else, a way with GPO to pre-populate that URL would be helpful.

 

[ThomB_3CX]

You have four ways to provision the app. All are pretty much straght forward.

1. Via Provision button from webclient
2. Via Webclient Credentials (if 2FA is enabled, the pin is requested also)
3. Via Single Sign On
4. Via PnP

 

[BALangford]

Can you expand on points 3 and 4? (Or link to documentation on it?)

Edit: I think I can guess on the PnP portion, I would have to figure out how to get that to broadcast across subnets however.

 

[Gasha]

Can you expand on points 3 and 4? (Or link to documentation on it?)

Edit: I think I can guess on the PnP portion, I would have to figure out how to get that to broadcast across subnets however.

For SSO you would obviously have to set up the M365 or Google integration, otherwise there would be no SSO functionality given that you could use.
I for one would also be interested in point 4, as we haven't really figured it out properly by ourselves, input would indeed be appreciated.

 

[ThomB_3CX]

For PNP, the requirements are that the Softphone needs to be on the same network as the PBX.

After this, these are the steps (on V20):
Keep the softphone in the Login screen
Login to the PBX
Admin
Phones
PNP Phones
Your Softphone should be listed there as App for Windows
Select it and click on Assign
Select the user that you want to assign to the Softphone and hit Ok

 

[BALangford]

Is it possible to drop an SBC onto a VLAN to configure the softphone? (I am testing this right now, and while the SBC picks up the softphone it seems unable to provision)

My setup is currently the PBX and all deskphones are on one vlan while desktops are on another. There is no restrictions on traffic between the two currently.

I have full access to DHCP/DNS/GPO/Intune if there is any additional ways to streamline the provisioning of the app via those methods.

 

[ThomB_3CX]

@BALangford no PNP provisioning of the softphone via SBC is currently not possible.

 

[PBX128]

It would be great if at least the 3CX URL could somehow be provided via DHCP, DNS, GPO or Powershell, so that users don't have to type it in themselves when they first start the 3CX app

Perhaps similar to IGEL? There you can create a DNS entry “igelrmserver” that points to the actual IGEL server. Perhaps the 3CX app could also try to call up a defined DNS entry such as “3cxserver” at startup?

 

[BALangford]

It would be great if at least the 3CX URL could somehow be provided via DHCP, DNS, GPO or Powershell, so that users don't have to type it in themselves when they first start the 3CX app

Perhaps similar to IGEL? There you can create a DNS entry “igelrmserver” that points to the actual IGEL server. Perhaps the 3CX app could also try to call up a defined DNS entry such as “3cxserver” at startup?

That would be great, perfect world would be able to have a one click Microsoft button that uses the currently authenticated Windows session against 365 to sign in and configure.

 

[PBX128]

Still waiting...

 

[jtarz]

I 2nd this. In V18, I would grab the .config when setting up the user, then securely loaded that during the user logon process. Boom. Every time someone logs in their 3cx also does. I tried using the provisioning link, but that's only good once. The .config still works with the softphone, but I have no way of generating the refresh token (found in the config file).

 

[fxbastler]

We generate the provision link

tcx+app:https://pbx.customer.fqdn/provisioning/prov-directory/TcxProvFiles/3cxProv_randomxyz200.xml

and start a browser with it.
We generate it on 3CX itself or using the 3CX Configuration API.

 

[SweetAction]

We generate the provision link

tcx+app:https://pbx.customer.fqdn/provisioning/prov-directory/TcxProvFiles/3cxProv_randomxyz200.xml

and start a browser with it.
We generate it on 3CX itself or using the 3CX Configuration API.

How have you figured out the randomxyz200 part?

 

[fxbastler]

How have you figured out the randomxyz200 part?

It's the user parameter PROVFILE.
3CX provisioning folder is the global parameter PROVISIONING_FOLDER.
Both are in the database, can be read out manually, can be obtained with some script on the 3CX or via xapi.

 

[fxbastler]

In the 3CX: https://www.3cx.de/forum/threads/standardkonfiguration-für-desktopapp.102543/post-433741

quick and dirty for all users via xapi and powershell:

$tcxurl = "mypbx.mydomain.de"       # needs port if not 443
$jsonauthbody = (@{
    Username="100"                  # 3CX user, maybe email address
    Password="Super_Secret0815"     # 3CX user password
    SecurityCode=""
} | ConvertTo-Json)

$LoginResponse = Invoke-RestMethod -Uri "https://$tcxurl/webclient/api/Login/GetAccessToken" -Body $jsonauthbody -Method POST -ContentType "application/json"
$headers = @{Authorization = "Bearer $($LoginResponse.Token.access_token)"}


$webroot = ((Invoke-RestMethod -uri "https://$tcxurl/xapi/v1/Parameters?`$search=`"WEB_ROOT_EXT_SEC`"" -headers $headers -Method GET -ContentType "application/json").Value).Value
$provdir = ((Invoke-RestMethod -uri "https://$tcxurl/xapi/v1/Parameters?`$search=`"PROVISIONING_FOLDER`"" -headers $headers -Method GET -ContentType "application/json").Value | where {$_.name -eq "PROVISIONING_FOLDER"}).Value
$usernrs = ((Invoke-RestMethod -uri "https://$tcxurl/xapi/v1/Users" -headers $headers -Method GET -ContentType "application/json").Value).Number | Sort
Foreach ($usernr in $usernrs)
{
    $provfilestr = ((Invoke-RestMethod -uri "https://$tcxurl/xapi/v1/DNProperties/Pbx.GetPropertiesByDn(dnnumber='$($usernr)')?`$search=`"PROVFILE`"" -headers $headers -Method GET -ContentType "application/json").Value).Value
    Write-Host "tcx+app:$($webroot)provisioning/$provdir/TcxProvFiles/$provfilestr"
}

The number in which the URL / name of the xml ends ist the extension number.

This allows you to provision the v18 and v20 3CX apps. However, the v18 app must be completely shut down.

If you need the 3cxconfig to provision 3CX Phone for Windows v16, just remove the
tcx+app: and download it via the https://... URL

 

[SweetAction]

Very helpful, thank you. I was looking for a programmatic way to generate that value, but it's far simpler to read it out from the DB.

I assume so, but doing a regenerate likely changes it, right?

 

[fxbastler]

Very helpful, thank you. I was looking for a programmatic way to generate that value, but it's far simpler to read it out from the DB.

But this needs shell access. We basically only have Debian 3CX and those are usually on separate telephony networks. Therefore the PowerShell xapi from another machine is a good option for us.

I assume so, but doing a regenerate likely changes it, right?

yes, something will change

 

[Thomas Six]

How can you add users to ringgroups with xapi powershell script?

 

[fxbastler]

How can you add users to ringgroups with xapi powershell script?

It's the same as with the 3CX configuration interface. You can take a look at it with the Browser Developer Tools. It explains everything about how 3CX does it, and you can do the same thing yourself.

It requires at least one GET to obtain the ringgroup ID and the ringgroup data and one GET to obtain the user ID. Then there's a PATCH to add the user with the ID to the ringgroup with the ID.

There have already been a few forum posts about this.

 

[Thomas Six]

I don't find. Is it possible to add the department when you make a ringgroup with xapi and how to update a setting from an existing ring group with xapi?