LDAP Authentication for End Users on Cisco Call Manager

[sienz.sienz]

We want to add a group of user from a different domain (XYZ.com) in our network to join the Cisco Call Manager.  They are going to use the Cisco Phone system.  The only issue that we have is the LDAP Authentication. It seems that we can only enter one LDAP Authentication for End Users.  Currently it is using the ABC.com domain.  We can see the users in both ABC and XYZ domain in the User Management in the CCM Admin (I guess because we can add more than 1 LDAP directory in CUCM) but it will not authenticate when the user from XYZ.com try to login to the CCM User Page.

CCM User Page is the user site access to modify their phone feature like speed dials, call forwarding, etc.

Is there any solution on the issue that we are experiencing?  I have no idea on how to add another LDAP Authentication.

Thank you,

sienz

[Jaime Valencia · Accepted solution]

You can only add one authentication config.

Review this

Additional Considerations for Microsoft Active Directory

In environments that employ a distributed AD topology with multiple  domain controllers geographically distributed, authentication speed  might be unacceptable. When the Domain Controller for the authentication  agreement does not contain a user account, a search must occur for that  user across other domain controllers. If this configuration applies,  and login speed is unacceptable, it is possible to set the  authentication configuration to use a Global Catalog Server.

An important restriction exists, however. Because a Global Catalog does  not carry the Employee ID attribute, this method cannot be used if the  Employee ID is used as the login. Only Domain Controllers may be used  with this attribute.

To enable queries against the Global Catalog, simply configure the LDAP  Server Information in the LDAP Authentication page to point to the IP  address or host name of a Domain Controller that has the Global Catalog  role enabled, and configure the LDAP port as 3268.

The use of Global Catalog for authentication becomes even more efficient  if the users synchronized from Microsoft AD belong to multiple domains,  because it allows Unified CM to authenticate users immediately without  having to follow referrals. For these cases, point Unified CM to a  Global Catalog server and set the LDAP User Search Base to the top of  the root domain.

In the case of a Microsoft AD forest that encompasses multiple trees,  some additional considerations apply. Because a single LDAP search base  cannot cover multiple namespaces, Unified CM must use a different  mechanism to authenticate users across these discontiguous namespaces.

As mentioned in the section on LDAP  Synchronization, in order to support synchronization with an AD  forest that has multiple trees, the UserPrincipalName (UPN) attribute  must be used as the user ID within Unified CM. When the user ID is the  UPN, the LDAP authentication configuration page within Unified CM  Administration does not allow you to enter the LDAP Search Base field,  but instead it displays the note, "LDAP user search base is formed using  userid information."

In fact, the user search base is derived from the UPN suffix for each  user, as shown in Figure 17-14.  In this example, a Microsoft Active Directory forest consists of two  trees, avvid.info and vse.lab. Because the same user name may appear in  both trees, Unified CM has been configured to use the UPN to uniquely  identify users in its database during the synchronization and  authentication processes.

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/7x/directry.html#wp1045381

HTH

java

If this helps, please rate

www.cisco.com/go/pdihelpdesk

[Jes80]

hello,

Since we can only allow one LDAP authentication.

If we change LDAP Authentication in UCM from ABC domain to  XYZ domain for testing and then change back to ABC.com

Is there anything we need to worry that willl break when we put it back to ABC.com ?

tks,

J

[Roger Kallberg]

You’re already asking this in another thread. Please do not create duplicates.