Your username or password is not correct Jabber & Self Care Portal

[dfmg]

I have two users who are getting the "Your username or password is not correct" with Jabber and the Self Care Portal, despite verify that their credentials are correct.

For both of them:
The CUCM Service Profile has all of the required Services such including IMP.

The Service Profile is assigned to the user on the End User account.

On the End-User account all of the Service Settings boxes are checked including the Home Cluster checkbox.

The user is the Owner on the CSF Device configuration page, and the device is in the Controlled Devices of the user.

The DN on the Jabber client is listed as the Primary Extension on the End User account.

We are using AD Sync, and their AD account works fine.  I've attached the log file for one of the users.

[Maren Mahoney]

Are both users in the Standard CCM End Users Access Control Group? (And should probably also be in the Standard CTI Enabled group, but not a requirement.) I don't see that in your list.

Maren

[dfmg]

Hello Maren,
Thank you for your quick response.

Yes, they are in both the Standard CCM End Users Access Control Group, as well as the Standard CTI Enabled group.

[Maren Mahoney]

Try unticking the box for IMP in their End User account, to see if they will register as SIP end points to CUCM without IMP services. If I'm reading the log right, the IMP config may be the issue. Regardless, it will help us narrow down the issue.

Let us know what happens. Also, would you be able to post the settings for the jabber-config.xml UC Service for these endpoints?

Maren

[dfmg]

Hello Maren,

I unticked the box for IMP in their account, but it did not register as SIP endpoint.

I'm still trying to figure out how to get the jabber-config.xml, I looked online, but the instructions seem like they are for a newer version of CUCM, and we have version 10.5.2.18900-15.

[Roger Kallberg]

You download the Jabber XML file from the TFTP server(s) in your CM cluster.

[dfmg]

Thanks Roger, 

I'll see if I can find someone on my end who has access to or TFTP servers.  

[Roger Kallberg]

Don’t you have access to the webUI of the CM?

[dfmg]

I do have access to the CUCM web UI.

[Roger Kallberg]

Okay, then you can access the TFTP files on the OS administration webUI

[dfmg]

Hi Roger,

Unfortunately, I do not have access to Cisco Unified OS Administration, only Cisco Unified CM Administration.

[Roger Kallberg]

What roles do you have assigned to your end user account in CM? Also do you use SSO?

[Ibrahim AlQumairi]

Maybe the are converted to be local users, try to delete one of the users and add it again from the LDAP.

[Carlo Poggiarelli]

Hi,

Please check if the AD base search is the same for both directory and authentication or if those user rely on that group.

On authentication instead of 389 standard ldap port try to use global catalogue port 3268.

HTH

Regards

Carlo

[Roger Kallberg]

AFAIK the ports you listed are for unsecured communications with AD/LDAP. That’s from what I know not applicable anymore since Microsoft made policy changes to not allow unsecured communications to AD/LDAP. There are very good documentation on cisco.com on how to setup secure communication for the LDAP synchronisation with AD in CM. Very shortly it uses other ports, 636 for regular domain controllers and  3269 for global catalog and requires certificate(s) to form the SSL connection. If you’re using internally sourced CA signed certificates in CM those are likely originated from the same CA as the certificates used in the AD system, so then there would be no need to upload any additional certificates to the trust store in CM.