Jabber AD Problems

[Sean McQuade]

Hi all,

I am having problems with AD over all devices. I have the AD server defined on the Presence server.

Desktop - Can search AD, but users show up as User ID eg. I am searching for John Smith, so I type Joh... and then user jsmith will appear in the results, not the full name. Similarly when added to contacts, this shows their User ID and not full name.

Mobile clients - Can't search the AD at all, it doesn't find any users. I have tried entering the AD details locally on the device and via the device configuration on CUCM.

Thanks

Sean

[j.faure]

Hello ,

Same issue for me , AD profile is defined on the CUPS. No connectivity with AD . You can find user already defined in CUPS as a contact but no new contacts consequently NO photo under contacts.

CUCM& CUPS  8.6.2

last version of Jabber client

[Aaron Harrison]

Hi

Jabber Windows - doesn't use the CUPS settings; it uses settings in an XML file you define. This is detailed in the admin guide, and there is a handy config generator here:

https://supportforums.cisco.com/docs/DOC-25778

Jabber Mobile - the info for the directory is specified on the 'Product Specific Configuration' section of the device in CUCM. If you have problems here, post up the details of what you have configured and/or generate a problem report from the client.

Regards

Aaron

[j.faure]

Hi Aaron

Thanks , i'm using Jabber Mobile and i've an issue with Jabber IPAD . According to Cisco doc and My tests :

Jabber windows use XML file

Jabber IM for IPhone use CUPS LDAP profile NOT LDAP attribute mapping

Jabber Phone for Iphone use 'Product Specific Configuration'  in CUCM

Jabber IM Android use CUPS LDAP profile NOT LDAP attribute mapping

Jabber Phone for Android use 'Product Specific Configuration'  in CUCM

Jabber IM for IPAD should use  CUPS LDAP and LDAP attribute mapping  ( conx only to CUPS)

Jabber Softphone for IPAD should use CUPS CTI , LDAP , Voice  profile  ( like windows)

working well for Jabber Iphone , android but NOT for IPAD , i can connect to CUPS and to CUCM but NOT to LDAP.

Brgds

[Aaron Harrison]

Can you post up your LDAP profile configuration from CUPS?

Do you have a filter in the LDAP config?

Aaron

[Sean McQuade]

I think my original problem might be a little different to what j.faure is experiencing.

We can search AD on desktop, but it only shows userid instead of the full name.

On mobile clients, we can search anything, on iPad, iPhone or otherwise. I have also added the AD details to the phone specific config.

Jabber-config.xml:

- 
- 
  EDI 
  1 
  1 
  0 
  0 
  cn 
  displayName 
  givenName 
  sn 
  mail 
  msRTCSIP-PrimaryUserAddress 
  ipPhone 
  mobile 
  homePhone 
  telephoneNumber 
   
  company 
  sAMAccountName 
  userPrincipalName 
  co 
  mailNickname 
  postalCode 
  st 
  streetAddress 
  0 
  5 
  0 
  true 
  sAMAccountName 
  http://172.30.4.12:81/sAMAccountName.jpg 
  false 
- 
  true 
  false 
  true 
  

[Aaron Harrison · Accepted solution]

Hi Sean

I would try one of two things:

1) Remove all the custom field mappings from that jabber-config xml and see if the problem persists. A lot of those look default so there's no point having them. Maybe one of them is wrong?

2) I would do a packet cap with wireshark. Run a search, see what comes back - search the results for the string that is displayed in Jabber and see what ldap attribute it is coming from.

Aaron

[Aaron Harrison]

Also check your AD for the account - have a look at what the displayName and cn fields are. It might be that your AD guys squash those and put in the username instead of the default fn/sn combination.

Aaron

[Sean McQuade]

Oops, I meant to hit reply there instead of "correct answer".

Anyway, the Full Name in Desktop isn't a huge issue, just a "would be nice to have". The real issue here is that users on iPhone and iPad have no way to search for contacts in the corporate directory or to add contacts. I'm not sure how I can get a packet capture from this unless I try to capture all the traffic ingressing from the wifi network.

[Aaron Harrison]

Hi Sean

Read this as no problem on mobiles:

On mobile clients, we can search anything, on iPad, iPhone or otherwise. I have also added the AD details to the phone specific config.

If you have 'End User Configuration Editing' enabled on the mobiles, they don't refresh settings from CUCM - I can't see on your screen grab what this is set to. They download them once on the first connection... so if you then change the LDAP params it doesn't apply. I always set this to disabled or it gets confusing, especially now the 'delete account' button on the mobiles seems to be disappearing.

Otherwise your settings look OK.

Have you verified that the username@domain combination you've used for the username is valid? i.e. tried binding with another simple LDAP client with those creds?

Does the iPhone or whatever show the directory as disconnected?

Have you run off a problem report?

Aaron

[Sean McQuade]

Apologies Aaron, I mistyped. Original post was:

Mobile clients - Can't search the AD at all, it doesn't find any users. 
I  have tried entering the AD details locally on the device and via the  device configuration on CUCM.

I  have end user editing disabled at the minute, but have also tried it  enabled and configuring the AD details locally and neither method works. I am using this same credentials for AD integration between AD and CUCM so I'm pretty sure that it works correctly. I  haven't got access to a corporate iPhone at the minute to check the  directory or run a problem report so will do that first thing on Monday.

Also, a quick question about the iPad in general - Is this able to do  corportate IM and Voice integration all in one? When I configure it and  add it as a CUP and then afterwards set up the "calling and video", I  can use IM for existing contacts, but can't search the corporate  directory or see a call button on any of my contacts - I can however  dial numbers by using the number pad. If I add the CUCM account first,  it asks me for directory details etc, meaning I can search corporate  directory and see the call button under users, but am unable to IM or to add any CUPs information. Is this by design?

I mostly just find this whole Jabber AD integration overly complicated and not very well documented as to what to configure where. You configure your LDAP server and LDAP profile in the CUP > Jabber > Settings but this seems to be only for he desktop clients? Then have to do your LDAP mappings in a Jabber-config.xml file. So what exactly do the LDAP attribute mappings at the bottom of CUP > Jabber > Settings affect? Where are you mapping to? Then you have to go to the mobile clients and re-enter details for AD integration and any mapping you want to do there? Why can't there be a centralised AD config for all clients?

[Aaron Harrison]

Hi Sean

I feel your pain - there's so little consistency between any of the Jabber products that it's difficult on several fronts:

- Customer's impression of what Jabber is, and what it actually is.... i.e. Cisco harp on about video/IM/collaboration all the time, and yet Jabber on the most common mobile platforms (Android/iPhone) is basically a voice-only softphone. Yes, there is a seperate IM app, but why? Why can every other developer on the planet write apps that work on both iPhone and iPad consistently, but Cisco have an app for iPad that does all that you would expect (on a good day) and one for the iPhone that lags behind despite it being a far more likely communications platform (i.e. phone).

- Configuration of each is very different, configured through CUCM GUI, TFPT files, CUPS...

- Remote access... well.. don't get me started.

Re: your questions - yes, iPad does it all. The latest 9.2 version I installed seems to work a little differently for initial setup, is that what you have? It just asks for email address, and then when that doesn't work it prompts for more info.

The CUPS-based Jabber/Settings page for LDAP is now for Mac, legacy CUPC, and a few other things (UCCX CUP integration).

The mappings are between the fields that those clients use (e.g. userid, or telephone number) to fields in AD. THere is a standard mapping, but you might change it (if for example in AD you want to use ipPhone as the primary tel number, or you are using extension numbers as User ID in CUCM and need to map those together).

Jabber for Windows uses the XML config from CUCM TFTP file exclusively.

Basically if there is a set of LDAP settings in the Product Specific Configuraton section on the device page, it won't use CUPS or the Jabber XML file - you have to specify them on the device.

It is a pain to add to all devices... I imagine the way Cisco intend this to work is that you would put these properties in the 'System\Enterprise Phone Configuration' (most general) or the Common Phone Profile  (more specific) and only put them on the dev when you need to override them - but the list of properties on Ent Phone and Common Phone settings is not what it should be!

Aaron

[Sean McQuade]

Great answer Aaron - I'm glad I'm not the only one who has these frustrations with the product. For example, the answer you just gave me about the Jabber > Settings > LDAP Settings being used for MAC and Legacy; why doesn't it say that on the page!? I can find no documentation where it says what these mappings affect.

As for the iPad, maybe I have set it up incorrectly, but have been able to replicate the problem in my lab. I get the initial screen as you mentioned, then when it doesn't recognise the email address, I get this (sorry for all the screenshots - maybe this should be a seperate post):

I choose Unified Presence and enter my sign in info:

After logging in, it lets me enter my voice account:

However, after doing this; I don't see the call button on my contacts, and I'm not able to search the corporate directory for anyone

But if I use the number keypad and call their extension directly, it works:

If I delete this account and go back to the initial screen and choose "Unified Comms" instead of Presence:

This all works as expected and I can search the directory for contacts and can see the phone numbers and call buttons

But I am obviously unable to IM him as there is no place to add any details for a Presence server if you do it via this method.

[Aaron Harrison]

Hmm. that is odd.

A quick review of the docs suggests that if you initially log in to CUPS, it may use the Jabber/Settings config in CUPS for LDAP. If you connect to CUCM it would use the product page config - I can see you have the same settings on both.

Since it works in one mode and not the other that rules out connectivity issues etc.

So - are you sure you have the LDAP Profile you screenshotted earlier assigned to the user logging in (via CUPS) to the iPad?

I would say that the method of connecting to CUPS and then adding voice/video would be what I would do. Can you do that, allow a search to fail, and then run a problem report from settings/help?

Aaron

[jilfersalam]

I have the exact porblem as sean described when using jabber for ipad in CUPS + CUCM login. Did you guys resolve the issue? i have opened a new thread for this, still trying to figure what the issue is.

https://supportforums.cisco.com/thread/2207936