topic I think tthis works without in Unified Communications Infrastructure

Error while Trying To Update PIN in UCM Self-care Portal

Alok Jaiswal — Tue, 19 Mar 2019 19:13:49 GMT

Hi Folks,

I am running a 2 node cluster with 11.5 SU2 (CUCM & Unity) with PIN synchronization feature. I have followed the configuration and enable the feature.

I also looked at the video mentioned here.

https://www.youtube.com/watch?v=p6m4gPv0ikE&feature=youtu.be

However when i go to self-care portal and try to change the PIN i get an error saying "Error While Trying to Update PIN", however the PIN works and i can even login to my voicemail account with the new PIN.

So definitely PIN sync is happening but something is not working, and throwing an error.

Has anyone came across this issue considering the fact that 11.5 SU2 is still very new.

Regards,

Alok

I used the initial release of

Jaime Valencia — Fri, 17 Mar 2017 17:02:57 GMT

I used the initial release of 11.5(1) to make the video and you can see it was working fine, I just updated to SU2 last week, I'll try later and let you know if I see the same issue.

Just tested and had no

Jaime Valencia — Fri, 17 Mar 2017 19:00:25 GMT

Just tested and had no problems, tried twice, same result

Thanks Jaime. I wanted to

Alok Jaiswal — Fri, 17 Mar 2017 22:57:22 GMT

Thanks Jaime. I wanted to confirm before i start digging in the logs.

I remember your video you are using same username/password everywhere but in my case the username are different on Unity and CUCM, not sure if it has anything to do with the permissions.

Let me collect some RTMT logs and then i will update this post, if i can find anything in the logs, if not TAC is the only way to go.

Regards,

Alok

Jaime,

bestephens — Fri, 31 Mar 2017 17:53:41 GMT

Jaime,

This may be a dumb question but... Do the Credential policy and Authentication rules need to be inline for PIN synchronization to work? I would assume so but I can't seem to find it documented anywhere.

I am thinking of scenarios where if a PIN is set to expire before the other I would suspect that this causes issues. If an administrator doesn't make these changes will an error be passed if for instance CUCM only requires a 4 digit password and Unity Connection required a 5. Or even if one doesn't require Trivial and the other does require trivial check.

Thanks,

Brent Stephens

I don't think there's

Jaime Valencia — Mon, 03 Apr 2017 21:42:48 GMT

I don't think there's anything in the documentation that covers this, I'm not even sure if I have the same settings in my lab, I'd need to test and see if it errors out, but it might just be that it will only follow the rules of CUCM or CUC, depending on where you do the change.

Then it will simply sync the PIN to the other server's DB directly, bypassing those settings.

I think tthis works without

Alok Jaiswal — Mon, 03 Apr 2017 22:05:42 GMT

I think tthis works without that as well. If i remember correctly i tried to match most of the password rules but still missed some. And i saw it was working but with the error above.

Then i also realized that the user i created same as unityadmin in cucm doesn't have standard axl role. so i assigned that role as well. But still i have the same error.

I tried to look in tomcat logs, and database logs but can't find much info. But its not so important from implementation point of view, so i moved on and will work when i have some time.

Finally i was able to fix

Alok Jaiswal — Tue, 11 Apr 2017 06:38:48 GMT

Finally i was able to fix this issue today. And its just a matter of reading the document more clearly and you need to believe a bit on your intuition as well.

So i collected the Tomcat and Tomcat security logs and saw the below.

From Tomcat Security logs it says PIN change is successful,

2017-04-11 16:20:24,829 DEBUG [http-bio-443-exec-204] impl.AuthenticationDB - updateCredential: updating Credentials for userId =kytec_test

2017-04-11 16:20:24,834 DEBUG [http-bio-443-exec-204] impl.AuthenticationDB - updateCredential: readCredential result userOID_ =e098d2aa-8635-0062-af73-3b2220e8f297 credentialOID_=7367befe-728c-497a-9d0f-0771e42f5349 isInactive_ =false daysToExpiry_=0 needWarning_ =0 timeLastAccessed_=1491891624 hackCount_ =0 timeHackedLockout_=0 timeOfLockout_ =0 timeLastChanged_=1491890279 timeLastHacked_ =0 userType_=1 endUserStatus_ =1 lastSuccessfulLoginTime_ = 0 lastSuccessfulLoginIp_ = null lastUnsuccessfulLoginIp_ = null minCharsToChange_ = 1

2017-04-11 16:20:24,834 DEBUG [http-bio-443-exec-204] impl.AuthenticationDB - minCharsToChangeValidation : Minimum character change between successive password validation is skipped for credentials except password

2017-04-11 16:20:24,835 DEBUG [http-bio-443-exec-204] impl.AuthenticationDB - updateCredential:imsInfo is1

2017-04-11 16:20:24,835 DEBUG [http-bio-443-exec-204] impl.AuthenticationDB - updateCredential:set imsInfo to1

2017-04-11 16:20:24,836 DEBUG [http-bio-443-exec-204] security.Log4jEncLogger - Entering HashTextSHA

2017-04-11 16:20:24,836 INFO [http-bio-443-exec-204] security.Log4jEncLogger - class java.security.MessageDigest$Delegate

2017-04-11 16:20:24,837 DEBUG [http-bio-443-exec-204] security.Log4jEncLogger - Exiting HashTextSHA

2017-04-11 16:20:24,850 DEBUG [http-bio-443-exec-204] impl.IMSCacheManager - clearCacheForUser: Removing cache for user kytec_test credentialType 4

2017-04-11 16:20:24,850 INFO [http-bio-443-exec-204] authentication.AuthenticationImpl - updateCredential: result = Result Code =0 Message =Successful

2017-04-11 16:20:24,850 DEBUG [http-bio-443-exec-204] auditing.AlarmSender - AlarmSender: getInstance

2017-04-11 16:20:24,851 DEBUG [http-bio-443-exec-204] authentication.AuthenticationImpl - Constructor:

2017-04-11 16:20:24,851 DEBUG [http-bio-443-exec-204] authentication.AuthenticationImpl - successfully read propertyfile - classname is com.cisco.security.ims.impl.CUCMUtil

2017-04-11 16:20:24,851 DEBUG [http-bio-443-exec-204] authentication.AuthenticationImpl - getApplicationCredential: Authenticating against DB.

2017-04-11 16:20:24,852 DEBUG [http-bio-443-exec-204] impl.AuthenticationDB - Constructor:

2017-04-11 16:20:24,856 INFO [http-bio-443-exec-204] security.Log4jEncLogger - Entering decryptPassword

2017-04-11 16:20:24,856 INFO [http-bio-443-exec-204] security.Log4jEncLogger - Use Dkey to decrypt data

2017-04-11 16:20:24,856 INFO [http-bio-443-exec-204] security.Log4jEncLogger - decryptPassword was successful

But the Tomcat Logs were showing a different story.

[11/Apr/2017:16:20:32 +1000] 10.90.4.27 10.90.4.27 kytec_test - 443 PUT /cucm-uds/private/user/kytec_test/credentials HTTP/1.1 400 146 9971

It results an HTTP error code 400.

Though the logs were not very helpful, it definitely gave me a pointer that i have to read the whole process one more time and see what am i missing. So i read both, the unity configuration guide and cucm installation guide which leads me to the below.

In Cisco Unity Connection Administration, go to Telephony Integrations > Phone System and select the Phone system associated with the user. On the PhoneSystem Basics page go to Edit > Cisco Unified Communication Manager AXL Servers. On the Edit AXL server page, configure the primary AXL server with valid username and password. The feature is not applicable for secondary AXL server.

Where it says the feature is not available for secondary AXL server. Since i am running the unity connection cluster i tried to removed secondary AXL server but no luck still. Then i went back to CUCM and looked at the application server configuration.

I had added both the nodes of cluster under application server.

Hence i removed one of the node and tried again. And it works properly now.

I also has setup the PIN policy same on unity as well as CUCM just to avoid any errors, though i found it working with different values for the parameters under the policy on both the servers.

Regards,

Alok