LDAP Authentication to multiple domains

[abraham23482]

Hi All,

We have a requirement to integrate our CUCM cluster to a 2nd domain. We were able to add the second one as an additional LDAP directory and import the users. 

The issue is with LDAP authentication. There is no option to add another LDAP authentication config. So users cannot login to Jabber or use the self service URLs. 

I read that SSO or LDAP Proxy are the solutions here but was wondering if there was an easier option without much change to how things work today? 

Can someone lead me to the best possible solution here and a documentation to do that? Thank you

Abraham

[Jaime Valencia]

If those are different forests, there is no way besides using ADAM/LDS.

[abraham23482]

Thank you Jamie and Chris

Can you please point me to a URL for the documentation about ADAM/LDS

Thanks

Abraham

[Jaime Valencia · Accepted solution]

http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-version-80/111979-ucm-multi-forest-00.html

[abraham23482]

Thank you both. 

Have a wonderful day. 

Abraham

[abraham23482]

Hi 

We hit another challenge here. We are on version 9.1 and to use ADAM / LDS the document says

" The number of user accounts to be synchronized must not exceed 60,000 accounts per CUCM Publisher. When more than 60,000 accounts need to be synchronized, the IP Phone Services Software Development Kit (SDK) must be used in order to provide a custom directory. See the Cisco Developer Network for additional details. When you use Unified CM Release 10.0(1) or later, the maximum number of user accounts supported is 160,000."

We are going to be more than 85000. Do you know if there is any workaround for this?

Abraham

[Chris Deren]

I am not aware of a workaround. Do you require all 85K accounts to be brought into CUCM? If not you can either put in LDAP filter or point to more explicit search bases.

[Chris Deren · Accepted solution]

http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-version-80/111979-ucm-multi-forest-00.html

[Chris Deren]

As Jaime points out if this is separate forest you're option is LDS. If this is another domain within the same forest you can simply points the authentication to the root of your forest. i.e. cn=company, cn=com.