Click-to-Call with Microsoft AD Username & Password

[adnan.sendogdular]

Hi,

I'm using Cisco Unified CM Administration 8.0.2.40000-1 with LDAP sync. Before LDAP sync I could use Click-to-Call application with Cisco Unified CM End Users which I did configure. When LDAP sync is disable, Click-to-Call application registering with my ip phone and I can make a call. But, when LDAP sync is enable, I can't register my username and make a call.

I receive a fault message like "Login Failed. Please ensure your user name and password are correct"

How can I use Click-to-Call with my Active Directory username and password.

Best regards,

Adnan Sendogdular

[William Bell]

Note that LDAP sync and LDAP auth are two separate features. LDAP sync can be enabled without LDAP auth. Also, note that when you enable LDAP sync the LDAP password is not synchronized or stored on the CUCM.

Does the issue appear when you enable LDAP sync without LDAP authentication?  If so, then user ID attributes (e.g. sAMAccountName) in LDAP don't match the CUCM end user user ID. I don't think this is what you are running into.  If the issue appears only when you enable LDAP authentication then your user credentials configured in the click-to-call client are incorrect.

So, I would check the password configured in click-to-call. Make sure it is the AD password.

HTH.

Regards,
Bill

[adnan.sendogdular]

Hi William,

As you said I enable only LDAP Sync for synchronize my AD Users to UCM. Users synchronized with UCM but user's passwords don't. It' s ok. I gave any password to users and I can logon to https:///ccmuser and I can use the Click-to-Call.

When I enable LDAP authentication with LDAP Sync, I can't logon to CCM user page or can't use the Click-to-Call. And I'm sure the password is my AD account's password.

Do you need any screenshot of my configuration?

Thanks for your reply.

Greetings.

[William Bell]

Based on your reply then the issue is either that the user's password is different in AD than in CUCM, the LDAP authentication configuration is incorrect, or the communication between CUCM and the LDAP authentication server is impaired.

1. You can test the first theory by having the user authenticate to the LDAP authentication server directly. Either via Windows logon, Exchange logon, or even mapping a network drive to the server. Your objecitive is to prove (or disprove) that the credentials are the same in AD and CUCM.

2. You can test the other two theories by staging a logon example and capturing the network messages exchanged between your CUCM publisher and the LDAP authentication server.

a. For testing set the LDAP channel to the authentication server to not use encryption.

b. Next, use a method similar to what is provided in the following URL to setup a network capture. You may want to add a filter on the LDAP server IP address to minimize noise in the capture file.

http://www.netcraftsmen.net/resources/blogs/networktraces-cisco-uc.html

Example with a filter:

admin:utils network capture file mycap count 100000 size all host all 10.3.2.21

Where 10.3.2.21 is changed to the IP address of your LDAP authentication server.

c. Next, attempt a logon to your CUCM publisher by going to the CCMUser page (https://publisherIPAddress/ccmuser)

d. After the logon fails, go to the console of the CUCM publisher (the one you opened in step 2b) and cancel the trace (Ctrl+C). Then retrieve the trace file as described in the above URL.

You can then review the trace file for errors or post it here for a community review. You may also be able to gleen some information from your application/system event logs on the publisher around the time of the test.

HTH.

Regards,

Bill

[jasonlnielsen]

Make sure that the username you are using in the Click to Call application matches EXACTLY as it is in CallManager with the sync enabled.

It is case sensitive.

Please rate if this helps.

[Douglas Fernando Fischer]

I believe thar your question is related with my question in this thread:

https://supportforums.cisco.com/thread/2098161