One easy thing to check: is the username all lower case in LDAP or the UCM End User database? The CUCM AXL interface that CCX uses to perform authentication requests considers the username as case sensitive as well as the password.
Can the user login to https:///ccmuser (note they need the Standard CCM End User right to test this)?
