Take a look here at the VCS config guides, section "Authentication of devices and accounts"
http://www.cisco.com/en/US/products/ps11337/products_installation_and_configuration_guides_list.html#anchor2
In general you would have to manually create (TMS 13.2 should also support ldap import) accounts on the TMS,
the passwords there would not match.
You disable NTLM on the VCS and point the authentication to the ldap server.
On the ldap server you would need a h350 directory with the sip usernames and passwords.
How you get this in there is more or less your problem. Not sure if you have users passwords
stored somewhere in cleartext, not sure if hashed passwords would work as well.
Maybe its possible to use HA1 hashes as well.
If the generic authentication is turned on the default zone the VCS it will not differ in between if its movi,
endpoint or infrastructure, so you would need to have acouts for your endpoints and h323 as well
(depending on your deployment). An extra VCS for movi could be an option as well. Also local subzones can come in handy.
There might be some other ways, options, limitations or challenges as well :-)
Good success
