topic Re: Your username or password is not correct Jabber & Self Care Po in Collaboration Applications

Your username or password is not correct Jabber & Self Care Portal

dfmg — Fri, 01 Mar 2024 15:29:58 GMT

I have two users who are getting the "Your username or password is not correct" with Jabber and the Self Care Portal, despite verify that their credentials are correct.

For both of them:
The CUCM Service Profile has all of the required Services such including IMP.

The Service Profile is assigned to the user on the End User account.

On the End-User account all of the Service Settings boxes are checked including the Home Cluster checkbox.

The user is the Owner on the CSF Device configuration page, and the device is in the Controlled Devices of the user.

The DN on the Jabber client is listed as the Primary Extension on the End User account.

We are using AD Sync, and their AD account works fine. I've attached the log file for one of the users.

Re: Your username or password is not correct Jabber & Self Care Po

Maren Mahoney — Fri, 01 Mar 2024 15:44:05 GMT

Are both users in the Standard CCM End Users Access Control Group? (And should probably also be in the Standard CTI Enabled group, but not a requirement.) I don't see that in your list.

Maren

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Fri, 01 Mar 2024 15:54:07 GMT

Hello Maren,
Thank you for your quick response.

Yes, they are in both the Standard CCM End Users Access Control Group, as well as the Standard CTI Enabled group.

Re: Your username or password is not correct Jabber & Self Care Po

Maren Mahoney — Fri, 01 Mar 2024 16:10:38 GMT

Try unticking the box for IMP in their End User account, to see if they will register as SIP end points to CUCM without IMP services. If I'm reading the log right, the IMP config may be the issue. Regardless, it will help us narrow down the issue.

Let us know what happens. Also, would you be able to post the settings for the jabber-config.xml UC Service for these endpoints?

Maren

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Fri, 01 Mar 2024 17:09:28 GMT

Hello Maren,

I unticked the box for IMP in their account, but it did not register as SIP endpoint.

I'm still trying to figure out how to get the jabber-config.xml, I looked online, but the instructions seem like they are for a newer version of CUCM, and we have version 10.5.2.18900-15.

Re: Your username or password is not correct Jabber & Self Care Po

Roger Kallberg — Fri, 01 Mar 2024 17:39:58 GMT

You download the Jabber XML file from the TFTP server(s) in your CM cluster.

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Fri, 01 Mar 2024 18:08:26 GMT

Thanks Roger,

I'll see if I can find someone on my end who has access to or TFTP servers.

Re: Your username or password is not correct Jabber & Self Care Po

Roger Kallberg — Fri, 01 Mar 2024 18:18:52 GMT

Don’t you have access to the webUI of the CM?

Re: Your username or password is not correct Jabber & Self Care Po

Ibrahim AlQumairi — Fri, 01 Mar 2024 18:23:56 GMT

Maybe the are converted to be local users, try to delete one of the users and add it again from the LDAP.

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Fri, 01 Mar 2024 18:47:00 GMT

I do have access to the CUCM web UI.

Re: Your username or password is not correct Jabber & Self Care Po

Roger Kallberg — Fri, 01 Mar 2024 19:19:24 GMT

Okay, then you can access the TFTP files on the OS administration webUI

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Fri, 01 Mar 2024 19:42:10 GMT

Hi Roger,

Unfortunately, I do not have access to Cisco Unified OS Administration, only Cisco Unified CM Administration.

Re: Your username or password is not correct Jabber & Self Care Po

Roger Kallberg — Fri, 01 Mar 2024 19:59:42 GMT

What roles do you have assigned to your end user account in CM? Also do you use SSO?

Re: Your username or password is not correct Jabber & Self Care Po

Carlo Poggiarelli — Sat, 02 Mar 2024 22:16:50 GMT

Hi,

Please check if the AD base search is the same for both directory and authentication or if those user rely on that group.

On authentication instead of 389 standard ldap port try to use global catalogue port 3268.

HTH

Regards

Carlo

Re: Your username or password is not correct Jabber & Self Care Po

Nithin Eluvathingal — Sun, 03 Mar 2024 01:36:04 GMT

Since Selfcare is not functioning for the user experiencing issues, the problem does not lie within the Jabber configurations. Instead, it appears to be related to the user account itself, which is synchronized from Active Directory (AD). Here are some questions that come to mind:

Does this user appear as an active LDAP-synced user on the CUCM End User page?
Do these users belong to the same search base that you defined on the CUCM LDAP authentication page?

Re: Your username or password is not correct Jabber & Self Care Po

Roger Kallberg — Sun, 03 Mar 2024 07:34:35 GMT

AFAIK the ports you listed are for unsecured communications with AD/LDAP. That’s from what I know not applicable anymore since Microsoft made policy changes to not allow unsecured communications to AD/LDAP. There are very good documentation on cisco.com on how to setup secure communication for the LDAP synchronisation with AD in CM. Very shortly it uses other ports, 636 for regular domain controllers and 3269 for global catalog and requires certificate(s) to form the SSL connection. If you’re using internally sourced CA signed certificates in CM those are likely originated from the same CA as the certificates used in the AD system, so then there would be no need to upload any additional certificates to the trust store in CM.

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Mon, 04 Mar 2024 15:47:47 GMT

Hello Nithin,

The answer is yes to both questions, however, it does seem like an AD sync issue. It's odd because the usernames seem to sync from AD to Cisco CUCM, but none of the new users we are adding are able to sign in for one of our domains. It seems like the usernames get synced, but not the passwords. There've been no configuration changes to my knowledge, but I'm working with another admin who has more access who can hopefully shed some light on the issue.

Re: Your username or password is not correct Jabber & Self Care Po

Roger Kallberg — Mon, 04 Mar 2024 16:53:54 GMT

Passwords are actually never synced from LDAP to CM. It's used in real time against whatever authentication you define for the LDAP authentication.

Red arrow points to where you define the sync of user accounts and and green arrow points to where you define the authentication. These are two independent things.

Re: Your username or password is not correct Jabber & Self Care Po

Nithin Eluvathingal — Mon, 04 Mar 2024 16:14:46 GMT

As Roger Kallberg pointed out in his response, the password is never synchronized. It is not stored on the Cisco Unified Communications Manager (CUCM); instead, real-time authentication is performed. In this particular scenario, I suspect that the search base configured for LDAP authentication does not encompass these specific users. You might want to consider keeping the authentication at the domain level rather than restricting it to the organizational unit (OU).

Re: Your username or password is not correct Jabber & Self Care Po

dfmg — Tue, 19 Mar 2024 12:09:39 GMT

The issue for us is now resolved after our sys admin restarted the XCP Connection Manager and XCP Authentication Service on IMP nodes and restarted Cisco User Data Services on the CUCM Publisher and Subscriber.