LDAP Integration with CUCM 9.0

We would like to use LDAP to sync all of our users from Active Directory. All of our current CM Users are local, the problem is that they have the same user names as our Active Directory users. From what I understand this is going to be a problem because:
"If accounts from LDAP match an existing Unified CM account that is not marked as an LDAP synchronized account, then these accounts are ignored."
Does that mean we will have to delete all our existing CM users in order to sync the LDAP users correctly? Is there a best practice for this? Once we syncronize the LDAP users how to I ensure that the user gets associated with the proper phone? Or do I have to visit each user individually?

I just did a quick test for this, my lab CUCM 9 is already LDAP integrated, but I created a local user, then I created that same local user in my LDAP OU, and performed a full sync.
The user is no longer showing as a local active user, but as an active LDAP synchronized user.
Which was my thought, there's only one conversion, from LDAP to local.
The behavior is just as with any previous release, local users who match an LDAP user after you enable it, are just updated, and kept with all their configurations.
I checked the option to turn it back again into a local user, did a full sync, and it's again an active LDAP user.
HTH
java
if this helps, please rate
www.cisco.com/go/pdihelpdesk

Similar Messages

Jabber for Windows - without LDAP integrated with CUCM Jabber UDS - NO PEOPLE CAN SEARCH

Hi all Jabber Experts,
I have the CUCM, which is the versin 8.6 and the Presence Server, which is the version 8.6, that is not integrated the LDAP, but I want to deploy the Jabber for Windows.
So I would use the UDS to deploy the Jabber for Windows (modified the XML and uploaded to the CUCM TFTP server).
Finally, that can login the users, which is manually added from CUCM.
But I cannot search other users from the Bubby List. Any idea for that?

First of all, either you use CUCM 8.6 with CUPS 8.6, or you use CUCM 9.1 with IM&P 9.1, what you're mentioning is just impossible as they're not compatible and that's not supported.
HTH
java
if this helps, please rate
www.cisco.com/go/pdihelpdesk

LDAP integration with ISE

We are doing an LDAP integration with ISE but we are getting following error. We are not able to identiry the problem when we tested the following scenirios.
1. When we check with Anonymous access we are successful and we get the message “ Bind Successful to gluetest.systems.XXXX:3269”
2. When we use the user name and password CN=GRHIIISEPOC,OU=,XXXX, DC=YYYY, DC=ADROOTTEST,DC=YYYY. We are not successful and we get the message “ Test Failed: Invalid Admin Credentials or Security Settings: Check Admin Username and Password and make the security settings are compatible with the server:”
Please confirm is the user id what i am using is not having an admin preveliages or i am entered the parameters correctly.
Thanks

Did you use softerra or an ldap browser to pull the dn of this user account.
Thanks
Sent from Cisco Technical Support Android App

UCCX 7.0.1SR5 to 8.0 upgrade while also adding LDAP integration for CUCM - what happens to agents and Historical Reporting data?

Current State:
•    I have a customer running CUCM 6.1 and UCCX 7.01SR5. Currently their CUCM is *NOT* LDAP integrated and using local accounts only. UCCX is AXL integrated to CUCM as usual and is pulling users from CUCM and using CUCM for login validation for CAD.
•    The local user accounts in CUCM currently match the naming format in active directory (John Smith in CUCM is jsmith and John Smith is jsmith in AD)
Goal:
•    Upgrade software versions and migrate to new hardware for UCCX
•    LDAP integrate the CUCM users
Desired Future State and Proposed Upgrade Method
Using the UCCX Pre Upgrade Tool (PUT), backup the current UCCX 7.01 server.
Then during a weekend maintenance window……
•    Upgrade the CUCM cluster from 6.1 to 8.0 in 2 step process
•    Integrate the CUCM cluster to corporate active directory (LDAP) - sync the same users that were present before, associate with physical phones, select the same ACD/UCCX line under the users settings as before
•    Then build UCCX 8.0 server on new hardware and stop at the initial setup stage
•    Restore the data from the UCCX PUT tool
•    Continue setup per documentation
At this point does UCCX see these agents as the same as they were before?
Is the historical reporting data the same with regards to agent John Smith (local CUCM user) from last week and agent John Smith (LDAP imported CUCM user) from this week ?
I have the feeling that UCCX will see the agents as different almost as if there is a unique identifier that's used in addition to the simple user name.
We can simplify this question along these lines
Starting at the beginning with CUCM 6.1 (local users) and UCCX 7.01. Let's say the customer decided to LDAP integrate the CUCM users and not upgrade any software.
If I follow the same steps with re-associating the users to devices and selecting the ACD/UCCX extension, what happens?
I would guess that UCCX would see all the users it knew about get deleted (making them inactive agents) and the see a whole group of new agents get created.
What would historical reporting show in this case? A set of old agents and a set of new agents treated differently?
Has anyone run into this before?
Is my goal possible while keeping the agent configuration and HR data as it was before?

I was doing some more research looking at the DB schema for UCCX 8.
Looking at the Resource table in UCCX, it looks like there is primary key that represents each user.
My question, is this key replicated from CUCM or created locally when the user is imported into UCCX?
How does UCCX determine if user account jsmith in CUCM, when it’s a local account, is different than user account jsmith in CUCM that is LDAP imported?
Would it be possible (with TAC's help most likely) to edit this field back to the previous values so that AQM and historical reporting would think the user accounts are the same?
Database table name: Resource
The Unified CCX system creates a new record in the Resource table when the Unified CCX system retrieves agent information from the Unified CM.
A Resource record contains information about the resource (agent). One such record exists for each active and inactive resource. When a resource is deleted, the old record is flagged as inactive; when a resource is updated, a new record is created and the old one is flagged as inactive.

Jabber cannot Call - Integration with CUCM/AD

Dear all,
I installed CUCM 9.1.1 and CUPS 9.1.1 with Jabber client 9.0.1.
when I run Jabber on a joined domain PC (login with AD username and password), there are no problem with the calling ability.
But when I try to use a non-join domain PC (I am using VPN to connect to office network and using my personal PC), only the chatting feature that are available. I cannot loggin to phone accounts and cannot make any calls with my Jabber client.
Should I use UDS integration with AD?
Thanks,
Hasan

Hi Hasan,
Can you take a look on this thread:
https://supportforums.cisco.com/message/3914353#3914353
If you still have problem connecting, can you try with newer version of Jabber?
Regards,
Srdjan

LDAP Synchronisation with CUCM with multiple forest

Hello,
We have CUCM 10.5.
We want to add in CUCM multiple forest (we have multiple company with different domain name) using LDAP authentification so all the user/password sync with CUCM.
We have as distinguished name CN=xxxx,CN=Users,DC=xxx,DC=local and for search base CN=xxxx,CN=Users,DC=xxx,DC=local.
Can we add in the distinguished name and search base the information for multiple forest using the same username/password?
If it not possible is there an easy way to achieve that?
Any help would be appreciate.
Thank you

http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/srnd/collab10/collab10/directry.html#pgfId-1133454

Cisco TS 320 integration with CUCM

Dear Expert,
Is there any way we can integrate the TS 320 with CUCM without any conductor.
Means by SIP trunk or as Conference bridge.
BR

I have TS on Media 320, so its means we can not use it as locally managed.
The TelePresence Server on Media 310/320 and Cisco TelePresence Server on Virtual Machine do not support locally managed mode; on these platforms, the
TelePresence Server must be managed by a system like Cisco TelePresence Conductor or Cisco TelePresence Exchange System.
BR

Need Urgent Help on Meeting Place Integration with CUCM 7.1 and AS5400 PSTN Gateway

Hi,
This is first time I am on this forum.
I have already tried going through a lot of docs on docwiki.cisco.com but couldn't find complete configuration help.
I have to integrate Meeting Place 8.X with an existing CUCM and an E1 gateway (PSTN Gateway) AS5400.
The CUCM is already part of a Telepresence Environment. I need to create a SIP trunk between AS5400 and CUCM 7.1 and then create a Trunk between AS5400 and Cisco Unified MP 8.X and then between CUMP and CUCM.
I need help on AS5400 SIP Configs as well as parameters I need to cover on CUCM (Though I have done some basic dial-peer configs but they haven't been of much help).
Then I also need help on AS5400 SIP configs with CUMP 8.0
Any docs on Integration between CUMP and TP3000 will be of great help too.
Rgds,
Asim

I can get the Ricoh to register as sip endpoint, it answeres then imediatly disconnects. Doing a monitor with Wireshark looks like it attempts to negotiate t38 but fails. Any idea why this fails?
|160.260684000|         INVITE SDP (g711U)            |                   |SIP From:
|         |(5060)   ------------------> (5060)   |                   |
|160.338806000|         INVITE SDP (t38)              |                   |SIP Request
|         |(5060)   <------------------ (63435) |                   |
|160.339545000|         491 Request Pending           |                   |SIP Status
|         |(5060)   ------------------> (5060)   |                   |
|160.547894000|         406 Not Acceptable            |                   |SIP Status
|         |(5060)   <------------------ (63435) |                   |

Strip @domain on LDAP Integration with Cisco ISE?

Hi there ,
I got a WLC conntect with a Cisco ISE. There are two SSID authenticated against the ISE.
One SSID has AD-Integration as External Identity Source, the other SSID is authenticated through LDAP.
Authentication ist working fine.
When an user authenticates through LDAP, he/she has to enter "username@domain". The protocol is EAP-GTC.
How can I change the ISE that the user has only to enter "username" and the "@domain" part ist already set on the ISE?
Thansk a lot,
Norbert

From the user guide it seems that LDAP only allows you to strip the prefix/suffix and can't add the suffix.
http://www.cisco.com/en/US/docs/security/ise/1.1/user_guide/ise_man_id_stores.html#wp1054421
Strip start of subject name up to the last occurrence of the separator
Strip end of subject name from the first occurrence of the separator
Regards,
Jatin
Do rate helpful posts-

EP60 and LDAP integration with Micosroft AD- Issues

Hello,
We have configured EP6 SP11 and Microsoft AD for the user authentication as below.
MsAD:
AD_Compass_Domain
OU= Accounts
    OU=CORPORATE
          OU=IT
                User1 (User master record)
                 User2 (User master record)
            OU=FI
                 User3 (User master record)
OU=SAP_Portal
       OU=Corp_LDAP
             OU= Groups
                      SAP_Portal (Group Object and users are member of this group object as a link from all different OUs -user1,user2,user3)
              OU= Users
EP6 LDAP config:
Data Sources: Microsoft ADS (Flat Hierarchy) + Database
(We also tried Deep hierarchy didn't work)
LDAP Server:
User Path : OU=SAP_Portal,DC=NA,DC=CompassDev,DC=Corp
Group Path :
OU=Groups,OU=Corp_LDAP,OU=SAP_Portal,DC=NA,DC=CompassDev,DC=Corp
The issues:
1- SAP Portal could not see the group object when I browse the LDAP from portal.
2- SAP Portal is not allowing users (User1, User2, User3 etc which are member of the group object) to log in to the portal unless I put users directly under OU level like OU=Groups or if I point the path to the
OU=Accounts level which we do not want to do that because we have 50,000 users defined under OU=Accounts and we want just some of them like 3000 users. Portal gives the message
user authentication failed
Note: I checked the UME and I dont see the users listed in the group objects. Group object "SAP_Portal" is Universal Group object. (We also tried the global type)
3- When we put user directly under OU level, then users can log in but they are not able to change their password. We also can not change the user passwords through the Portal admin tools(UME or Visual Admin). I
have heard that without SSL, MsAD would not allow portal users to change their password.
a. (Portal internal user, [email protected], has
only read access on MsAD)
Note: We use 3268 as an AD port and 389 is also active I tried both of them but no chance.
Thanks for your help in advance.

Sasikanth,
Usually before you switch UME to AD, you would read it with an LDAP web compliant browser, to check if you could access your OU, Group, and Users. Are you sure you can read the complete LDAP structure on AD?
Kindly re-check the process, to see if you missed out on any steps.
http://help.sap.com/saphelp_erp2004/helpdata/en/cc/cdd93f130f9115e10000000a155106/frameset.htm
Check note 772620 - UME 4.0: Create Groups on Microsoft Active Directory Server
Regards,
James

Contact Center Ent. Integration with CUCM

I have CUCM 8.0 and CCX 8.0 and i am trying to setup the integration between them.
I have created a user on the CUCM and CTI Port and done the required configuration on the CCX.
Under CTI Port Status & IP Address it is giving unknown.
I have attached the configuration on CUCM and CCX.
Any help will be highly appreciated.

this is wrong , they have to be created on the UCCX , the UCCX will automaticly creat them on the CUCM.
check the link below :
http://www.cisco.com/en/US/docs/voice_ip_comm/cust_contact/contact_center/crs/express_8_0/configuration/guide/uccx801ag.pdf
Amer

Cisco BE6k with CUCM 10.X integration with Siemens with Hipath 3350 and 3550

Dear Experts;
We have one requirment from customer.
They have 4 branches with Siemens Hipath 3350 and 3550 PBX and they want to integrate with cisco CUCM 10.x.
The Head Quater with complete CUCM as IPT and branches with with Hipath 3350 and 3550 PBX.
CIsco TAC says interoperability doc is not available and also I can see tehre is no doc.
TAC Reply As below.
We do not have any documents about CUCM integration with Hipath 3350 and 3550 on our interoperability portal. This means that their integration with CUCM was never properly tested. So we can not confirm that all features will be working. But from CUCM perspective this is third-party device that can be integrated using SIP or ISDN (with Voice Gateway between them).
Link for interoperability portal:
http://www.cisco.com/c/en/us/solutions/enterprise/interoperability-portal/networking_solutions_products_genericcontent0900aecd805b561d.html#callmgr10
Regards
Debashis

If the Siemens supports SIP or H323 you can attempt to simply create a trunk between the systems and route calls via it. If IP integration is not an option then as pointed by TAC integrate via PRI circuit (preferably QSIG). From CUCM side it will be just another GW, similarly from Siemens side. You'll need to select which side is going to be ISDN network (I always use Cisco side) and then make the other side user.

CWMS v.2 - how to configure CWMS to authenticate user with CUCM

Hi,
I have a CUCM with no LDAP or AD integration. I already configured the directory integration with CUCM and it synchronized the user accounts to CWMS. When trying to login with end user account, password configured in CUCM doesn't work. What is the process to configure CWMS to authenticate with CUCM user database? Thanks.
-Alan

Hi Alan,
CUCM and LDAP integration is a prerequisite for using Directory Integration on CWMS.
http://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/1_5/Administration_Guide/Administration_Guide_chapter_01011.html#task_DB0D271D6EB1459EB4DA269461E93B36
Before You Begin
You must configure AXL and LDAP directory service on CUCM before you can use the directory integration feature. CUCM is required to import users into your Cisco WebEx Meetings Server system. Use CUCM to do the following:
Enable Cisco AXL Web Service
Enable Cisco directory synchronization
Configure LDAP integration
Configure LDAP authentication
-Dejan

ISE and LDAP Integration

Hello,
I have a question about the LDAP integration with the ISE:
Since the ISE has a limitation of reading only 100 groups, I cannot find the groups that I need to use on the authorization, and also the ISE cannot find group if I search for it directly.
What I mean here, that I can fetch the first 100 groups from the top of the directory, but when I search as example for any group (appear on the list or not) the ISE did not find it.
Even I tried to change the base DN and the search DN but without luck.
The ISE version is 1.1.4 installed on VM and the LDAP schema is AD.
Is there any missing information/tips required in such integration?

Hello,
I found a cisco doc that provides resolution of Key Features of Integration of Cisco ISE and LDAP .I hope this helps!
This section contains the following:
•Directory Service
•Multiple LDAP Instances
•Failover
•LDAP Connection Management
•User Authentication
•Authentication Using LDAP
•Binding Errors
•User Lookup
•MAC Address Lookup
•Group Membership Information Retrieval
•Attributes Retrieval
•Certificate Retrieval
http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_man_id_stores.html#wp1059913

Cannot start BI services after configuring LDAP integration

Hi all,
After configuring LDAP integration with OBIEE , I have stopped all BI services and started again. It throws following error:
<Nov 24, 2012 2:05:16 PM AST> <Error> <Security> <BEA-090892> <The loading of OPSS java security policy provider failed due to exception, see th
ption stack trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to
ore information. Error message: oracle.security.jps.JpsException: [PolicyUtil] Exception while getting default policy Provider>
<Nov 24, 2012 2:05:16 PM AST> <Critical> <WebLogicServer> <BEA-000386> <Server subsystem failed. Reason: weblogic.security.SecurityInitializatio
tion: The loading of OPSS java security policy provider failed due to exception, see the exception stack trace or the server log file for root c
If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more information. Error message: oracle.security.jps
ception: [PolicyUtil] Exception while getting default policy Provider
weblogic.security.SecurityInitializationException: The loading of OPSS java security policy provider failed due to exception, see the exception
trace or the server log file for root cause. If still see no obvious cause, enable the debug flag -Djava.security.debug=jpspolicy to get more in
ion. Error message: oracle.security.jps.JpsException: [PolicyUtil] Exception while getting default policy Provider
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.loadOPSSPolicy(CommonSecurityServiceManagerDelegateImpl.java:1398)
        at weblogic.security.service.CommonSecurityServiceManagerDelegateImpl.initialize(CommonSecurityServiceManagerDelegateImpl.java:1018)
        at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:873)
        at weblogic.security.SecurityService.start(SecurityService.java:141)
        at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.JpsRuntimeException: oracle.security.jps.JpsException: [PolicyUtil] Exception while getting default policy Provid
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:293)
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:284)
        at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:270)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.JpsException: [PolicyUtil] Exception while getting default policy Provider
        at oracle.security.jps.internal.policystore.PolicyUtil.getDefaultPolicyStore(PolicyUtil.java:899)
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:291)
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:284)
        at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:270)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        Truncated. see log file for complete stacktrace
Caused By: java.security.PrivilegedActionException: oracle.security.jps.JpsException: [PolicyUtil] Unable to obtain default JPS Context!
        at java.security.AccessController.doPrivileged(Native Method)
        at oracle.security.jps.internal.policystore.PolicyUtil.getDefaultPolicyStore(PolicyUtil.java:844)
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:291)
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:284)
        at oracle.security.jps.internal.policystore.JavaPolicyProvider.<init>(JavaPolicyProvider.java:270)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.JpsException: [PolicyUtil] Unable to obtain default JPS Context!
        at oracle.security.jps.internal.policystore.PolicyUtil$1.run(PolicyUtil.java:860)
        at oracle.security.jps.internal.policystore.PolicyUtil$1.run(PolicyUtil.java:844)
        at java.security.AccessController.doPrivileged(Native Method)
        at oracle.security.jps.internal.policystore.PolicyUtil.getDefaultPolicyStore(PolicyUtil.java:844)
        at oracle.security.jps.internal.policystore.PolicyDelegationController.<init>(PolicyDelegationController.java:291)
        Truncated. see log file for complete stacktrace
Caused By: oracle.security.jps.service.idstore.IdentityStoreException: JPS-00056: Failed to create identity store service instance idstore.ldap.
er:idstore.ldap. Reason: oracle.security.jps.JpsRuntimeException: JPS-00027: internal error You configured a generic WLS LDAPAuthenticator.
The identity store type cannot be determined. Please choose an LDAP Authentication provider that matches your LDAP server.
        at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.getIdStoreConfig(LdapIdentityStoreProvider.java:195)
        at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.access$300(LdapIdentityStoreProvider.java:70)
        at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider$NoLibOvd.getInstance(LdapIdentityStoreProvider.java:242)
        at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.getInstance(LdapIdentityStoreProvider.java:114)
        at oracle.security.jps.internal.idstore.ldap.LdapIdentityStoreProvider.getInstance(LdapIdentityStoreProvider.java:70)
        Truncated. see log file for complete stacktrace
>
<Nov 24, 2012 2:05:16 PM AST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FAILED>
<Nov 24, 2012 2:05:16 PM AST> <Error> <WebLogicServer> <BEA-000383> <A critical service failed. The server will shut itself down>
<Nov 24, 2012 2:05:16 PM AST> <Notice> <WebLogicServer> <BEA-000365> <Server state changed to FORCE_SHUTTING_DOWN>
D:\OraHome\Middlleware>I was not able to login to console since admin server not getting started.
Kindly help me to overcome this issue.
Thanks,
Haree

Thanks for the reply Veeravalli.
I have stoped the services and delete the config.lok file then edited the config.xml file under *%MW_HOME%\user_projects\domains\bifoundation_domain\config* . Then started the BI services. Now its working fine.
Thanks,
Haree

LDAP Integration with CUCM 9.0

Similar Messages

Maybe you are looking for