CTI Invalid Credentials

[Randall Jackson]

Recently, we lost the ability to control desk phones from Jabber. We are able to authenticate to the client using our Windows integrated authentication, but after sign in, our desk phone control has a red X and says invalid credentials. The Jabber client log file shows the following. We restarted the CTI Manager on the primary CTI Gateway server and also the UP Sync Agent server on the presence server where the clients are registered. We have not been able to resolve this issue. Anyone have any suggestions? Thanks.

2013-04-25 11:15:35,163 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: Leave CMeetingMgrImpl::CalcMeetingAlert

2013-04-25 11:15:35,164 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: CTriMeetingFSM::OnMergeReady FSM is idle, check waiting refresh today

2013-04-25 11:15:35,164 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: Leave CTriMeetingFSM::OnMergeReady

2013-04-25 11:15:35,164 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: Leave CTriMeetingFSM::OnOfflineReady

2013-04-25 11:15:35,165 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: Leave CTriMeetingFSM::OnList

2013-04-25 11:15:35,165 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: Leave CMeetingMgrImpl::ListEvents

2013-04-25 11:15:35,165 DEBUG [0x00003108] [ied\featuresets\adapters\imp\Log.cpp(32)] [JabberWerx] [IMPStackCap::Log::log] - [MeetingMgr.dll]: Leave CMeetingMgrImpl::OnOnlineAccountReady

2013-04-25 11:15:35,165 INFO  [0x00001c60] [ervices\impl\FeatureSetInfoImpl.cpp(208)] [feature-set-info] [FeatureSetInfoImpl::Start] - Starting Feature Set 3000 successfully completed

2013-04-25 11:15:35,166 INFO  [0x00001c60] [d\services\impl\FeatureSetsImpl.cpp(153)] [feature-sets] [FeatureSetsImpl::StartImpl] - Starting Feature Set 3000 completed

2013-04-25 11:15:35,166 INFO  [0x00001c60] [d\services\impl\FeatureSetsImpl.cpp(135)] [feature-sets] [FeatureSetsImpl::StartImpl] - Starting Feature Set 3003

2013-04-25 11:15:35,166 INFO  [0x00001c60] [ervices\impl\FeatureSetInfoImpl.cpp(162)] [feature-set-info] [FeatureSetInfoImpl::Start] - Start requested for Feature Set 3003 (byInference:false)

2013-04-25 11:15:35,166 INFO  [0x00001c60] [ervices\impl\FeatureSetInfoImpl.cpp(165)] [feature-set-info] [FeatureSetInfoImpl::Start] - Feature Set 3003 not yet started, so commencing actual start process

2013-04-25 11:15:35,166 INFO  [0x00001c60] [ervices\impl\FeatureSetInfoImpl.cpp(179)] [feature-set-info] [FeatureSetInfoImpl::Start] - Starting dependencies for Feature Set 3003

2013-04-25 11:15:35,166 INFO  [0x00001c60] [ervices\impl\FeatureSetInfoImpl.cpp(190)] [feature-set-info] [FeatureSetInfoImpl::Start] - Completed starting dependencies for Feature Set 3003

2013-04-25 11:15:35,166 INFO  [0x00001c60] [ervices\impl\FeatureSetInfoImpl.cpp(192)] [feature-set-info] [FeatureSetInfoImpl::Start] - Starting Feature Set 3003

2013-04-25 11:15:35,166 INFO  [0x00001c60] [nified\framework\UnifiedFactory.cpp(181)] [unified-factory] [UnifiedFactory::StartFeatureSet] - Starting Feature Set 3003 on provider

2013-04-25 11:15:35,167 DEBUG [0x00003108] [ed\framework\ServicesDispatcher.cpp(124)] [services-dispatcher] [ServicesDispatcher::pumpNext] - pumpNext.executed (12552,class csf::BlockingTask)

2013-04-25 11:15:35,167 DEBUG [0x00003108] [ed\framework\ServicesDispatcher.cpp(122)] [services-dispatcher] [ServicesDispatcher::pumpNext] - pumpNext.executing (12552,TelephonyAdapter::onAuthenticationStatusChange)

2013-04-25 11:15:35,167 DEBUG [0x00003108] [hony\TelephonyAdapterDispatcher.cpp(692)] [TelephonyAdapter] [TelephonyAdapter::onAuthenticationStatusChange] - Authentication Status: [eFailed]

2013-04-25 11:15:35,167 DEBUG [0x00003108] [telephony\TelephonyAdapterUtils.cpp(609)] [TelephonyAdapter] [TelephonyAdapter::updateTelephonyServiceAuthenticationStatus] - ECC AuthenticationStatus : [eFailed] ECC Authentication Failure Code: [eCredentialsRejected]

2013-04-25 11:15:35,167 DEBUG [0x00003108] [telephony\TelephonyServiceImpl.cpp(1177)] [csf-unified.telephony.TelephonyServiceImplLogger] [TelephonyServiceImpl::onTelephonyServiceAuthenticationStatusChanged] - TelephonyServiceAuthenticationStatus has changed from [InProgress] to [InValidCredentials]

2013-04-25 11:15:35,167 DEBUG [0x00003108] [l\base\TelephonyServiceBaseImpl.cpp(275)] [TelephonyService-Base-Impl] [TelephonyServiceBaseImpl::fireAuthenticationStatus] - fire AuthenticationStatus changed

2013-04-25 11:15:35,167 DEBUG [0x00003108] [tionplugin\StatusBarPhoneButton.cpp(894)] [plugin-runtime] [OnAuthenticationStatusChanged] - Detected OnAuthenticationStatusChanged

2013-04-25 11:15:35,167 DEBUG [0x00003108] [ccountstab\src/AccountsTabPlugin.cpp(93)] [plugin-runtime] [OnAuthenticationStatusChanged] - Detected OnAuthenticationStatusChanged

2013-04-25 11:15:35,168 DEBUG [0x00003108] [ccountstab\src/AccountsTabPlugin.cpp(99)] [plugin-runtime] [OnAuthenticationStatusChanged] - TelephonyAuthenticationStatus: InValidCredentials

2013-04-25 11:15:35,168 DEBUG [0x00003108] [phony\TelephonyServerHealthImpl.cpp(367)] [csf-unified.telephony.TelephonyServerHealthImpl] [TelephonyServerHealthImpl::commitIfNotAlreadyCommitted] - deskphone video server health has not been committed because no deskphone found in device list yet

2013-04-25 11:15:35,168 INFO  [0x00003108] [lcontrol\CallControlManagerImpl.cpp(605)] [csf.ecc.api] [ecc::CallControlManagerImpl::getLastCCMCIPServerUsed] - getLastCCMCIPServerUsed() =

2013-04-25 11:15:35,168 DEBUG [0x00003108] [phony\TelephonyServerHealthImpl.cpp(262)] [csf-unified.telephony.TelephonyServerHealthImpl] [TelephonyServerHealthImpl::updateHealth] - updating health with serverType [CucmSoftphone] serverHealthStatus [None] serverConnectionStatus [Disconnected] serverAddress [172.26.12.6 (CCMCIP)] serviceEventCode [InvalidCredential] transportProtocol [CCMCIP]

2013-04-25 11:15:35,168 DEBUG [0x00003108] [phony\TelephonyServerHealthImpl.cpp(262)] [csf-unified.telephony.TelephonyServerHealthImpl] [TelephonyServerHealthImpl::updateHealth] - updating health with serverType [CucmDeskphone] serverHealthStatus [Unhealthy] serverConnectionStatus [Disconnected] serverAddress [172.26.131.53 (CTI)] serviceEventCode [InvalidCredential] transportProtocol [CTI]

2013-04-25 11:15:35,168 DEBUG [0x00003108] [l\base\TelephonyServiceBaseImpl.cpp(281)] [TelephonyService-Base-Impl] [TelephonyServiceBaseImpl::fireAuthenticationStatus] - Exit fire AuthenticationStatus changed

2013-04-25 11:15:35,168 DEBUG [0x00003108] [\telephony\TelephonyServiceImpl.cpp(894)] [csf-unified.telephony.TelephonyServiceImplLogger] [TelephonyServiceImpl::onTelephonyPhoneModeUpdated] - TelephonyServiceImpl::onTelephonyPhoneModeUpdated(DeskphoneFailed)

2013-04-25 11:15:35,169 DEBUG [0x00003108] [l\base\TelephonyServiceBaseImpl.cpp(391)] [TelephonyService-Base-Impl] [TelephonyServiceBaseImpl::firePhoneMode] - fire PhoneMode changed

2013-04-25 11:15:35,169 DEBUG [0x00003108] [tionplugin\StatusBarPhoneButton.cpp(126)] [plugin-runtime] [OnPhoneModeChanged] - onPhoneModeChanged

[Dennis Mink]

First thing I would ask is, if it has worked prior, what has changed?

just a few thoughts:

The CTI server that Jabber uses, it get this from Presence  (Application>Cisco Jabber>CTI server). I am assuming this is where you have 172.26.131.53?  can you still ping that from CUPS?

also, one of the most obvious ones is line appearance, is there still a user ID associated with the extension on the phone and does is this user part of the "Standard CTI enable" user group?

[Randall Jackson]

Thanks for the reply.

Yes this has previously worked, for all users. Now it is broken for all users.

I've gone back through the deployment and integration guide for CUPS and CUCM. Validated all DN's and Phones have "allow cti device control". All users are a member of the Standard CTI Enabled group and their number is set as the primary extension on their user properties.

Yes, the primary CTI server configured in CUPS is the 131.53. This IP is reachable from the CUPS server where the users are registered. I'd imagine if it wasn't we'd probably be seing a message different than "invalid credentials"

The only known change in the environment was a reboot of all the Windows servers, including the LDAP Active Directory servers used by CUPS, as a plan maintenance activity to update them to the latest Microsoft Patches.

Thought process was that the CTI Manager service was no longer able to reach the LDAP server and stopped attempting authentication attempts which is why it was restarted. The restart did not work, so it does not appear to be a good analysis.

Any additional thoughts that might help point us in the right direction? Any known compatability issues with CUPS and Active Directory LDAP servers with specific MS patches?

Thanks.

[shannon3571]

Did you ever find a resolution for this issue?