In a secure design, the VCS (Control and Expressway) would require credentials for registration. Here is a design that is not described in the admin guides, but has been used quite successfully.
The VCS Control would have Active Directory Service enabled and joined to the Active Directory Domain. For the VCS to authenticate Movi/Jabber credentials against Active Directory before the SUBSCRIBE for provisioning is sent to the provisioning service, the Default Zone would be set for Check Credentials. For the SUBSCRIBE requests coming from the Expressway, the Traversal Zone on the VCS Control would also be set for Check Credentials. This will handle the authentication for provisioning.
The next part is the registration of the Movi/Jabber client. The subzone that the client will register to also needs to be set for Check Credentials. This is all you need for internal registrations (registration at the VCS Control).
For the Expressway, things get a little more complicated. For the provisioning subscription, the SUBSCRIBE is forwarded to the VCS Control. With the Traversal Zone on the VCS Control set for Check Credentials, you are all set. Now on to the registration to the Expressway. The subzone that the client will register to will need to be set for Check Credentials. Since the VCS Expressway does not have direct access to Active Directory, we need to utilize local credentials on the Expressway. A set of credentials will need to be configured in VCS Configuration > Authentication > Devices > Local Database. You will create a single name and password that all Movi/Jabber clients will use. The end user does NOT need to know of these credentials. The username and password is supplied to the Movi/Jabber client through the provisioning data that it has received. To configure that data, on the TMS, you need to configure a SIP Authentication Username and SIP Authentication Password in the provisioning configuration. For these options to be available, you need to make sure that you have uploaded the xml configuration template for the version of Movi/Jabber that you are using. The xml file is included with the full zip package of the client that can be downloaded from www.cisco.com. So that will take care of the Expressway registration. Now this creates an interesting situation with the VCS Control. The internal Movi/Jabber client will receive the same provisioning configuration, and will attempt to use those same credentials when registering to the VCS Control. The VCS Control is already set to authenticate the registration request against Active Directory, and ONLY Active Directory.
You will need to create an Active Directory account that matches those credentials. The Active Directory account does not need any special access. It is used for authentication purposes only. A few things to keep in mind: the SIP Authentication Username and SIP Authentication Password are stored in the provisioning configuration in clear text. That means that the data is sent in clear text. To be sure that this data is not compromised on the wire, be sure that you are using TLS for your Movi/Jabber SIP communication.
*UPDATE*
To further expand upon the configuration details above, please note that the account created in Active Directory that used for the SIP Authentication Username needs to reside in the same Windows Domain as the user account used by the client for provisioning. The reason is this:
When the Jabber client user input's their credentials, it will be in the form of DOMAIN\USERNAME. When the Provisioning data is received, only the "USERNAME" field is replaced. When the client auithenticates the registration with the new username, the domain name is not replaced. This could be an issue where the Active Directory domain structure contains multiple child or sub domains, or is a trust relationship is used for authentication.
For Example:
VCS is joined to parent domain (DOMAIN). The Jabber users reside in child domains (CHILDDOMAIN1 and CHILDDOMAIN2). a user account that has a samaccount name that matches the SIP Authentication Username must reside in both the CHILDDOMAIN1 *AND* CHILDDOMAIN2.
