CUPS 7, Users can't login to User Options or CUPC

[fieryhail]

I've recently nstalled CUPS 7 and am also running CUCM 7.  CUCM is synced with LDAP Active Directory, and the LDAP authentication is enabled.  Users can login to the /ccmuser page to change their options, personal address book, etc.  They login with their AD credentials and it all works perfectly.  CUPS pulled the user list from CUCM, and all the users show in CUPS properly, however, I am unable to login with CUPC 7.0.2 or even directly on the Unified Presence User Options page using the AD credentials.  I just get invalid username/password.  Any ideas on why this is or how to resolve it?  All the users that are to be using Presence have the capabilities assigned in CUCM so that should not be an issue.  Any help is greatly appreciated.  Thanks again!

[fieryhail]

Ok, a reboot of the CUPS server solved the issue with users being unable to login in, now they can login both with the CUPS User options and the CUPC application using their AD credentials.  However, this now brings up another issue.  CUPC constantly shows "Connecting" at the bottom, and there is "No Presence" at the top of CUPC.  I experienced this issue before using CUPS 8 which I learned through here was incompatible with CUPC 7.0.2.  However, CUPS 7 ought to work fine with CUPC 7.0.2, so am not sure what is wrong now.

After running the System Troubleshooter, the only thing that I can see that may be causing an issue (probably is),

Invalid Proxy Domain service parameter value (either the value is empty or is set to the default)                                                    Please configure a valid Proxy Domain service parameter (SIP Proxy service) (fix)

Any guidance on configuring this would be very helpful!  Thanks again!

[fieryhail]

Another update, CUPC is working as far as IP Desk Phone cntrol, but Voicemail is unavailable.  Also, No Presence, all I get is "Connecting" at the bottom of CUPC and eventually "Offline"  I feel I'm getting closer with this whole Presence thing, but still a ways off from usable.  Thanks again for any assistance.

[Jonathan Schulenberg]

The initial login issue you were seeing is frequently caused by using SSL (port 636 or 3269) for LDAP Authentication on CUCM. You have to install the directory certificates on the CUPS server as well.

As for the SIP Proxy Domain error, you definitely need to set this. CUPC 7.x clients are SIP SIMPLE clients and require a proxy domain to function. It's typically easiest to set this to the same as your internal DNS domain. Restart at least the SIP Proxy service after doing this.

[fieryhail]

THanks for the response, sorry, I fell asleep before updating lol.  I realized that I had to set the clusterwide FQDN on the CUCM which I did using a wildcard *.domain.com and then changed the service parameter on CUPS to the domain.com and then when I logged back into CUPC, presence was available.  Also fixed the LDAP issue so now contacts can be added from AD via the CUPC clients, that is working great.  Now I'm working on integrating CUC 7 for VM purposes.  One strange issue is that from inside the network I have full presence functionality, however since it is a dsktop I'm not using CUPC softphone, but instead deskphone control.  When a user connected via IPSec VPN (using Cisco VPN client) they wer able to login, LDAP works properly, but no Presence still.  What I'm wondering is since their CUPC is setup to use softphone (it's a laptop) and the softphone works properly, that runs on 5060/udp and presence runs over 5060/tcp, would that be causing any issues?  Is it the VPN itself that is causing issues?  I wouldn't think so as IPC and all other features of CUPC work fine, just no presence, it's a windows client and it gets Connected(Limited) at the bottom with the "No Presence" at the top.  Any thoughts would be welcome.  Sorry if the questions seem naive, I'm very new to the CUPS/CUPC aspect of UC.  Thanks again.

[shquresh]

Hi,

Verify if the incoming ACL is configure to ALL.. If not than add the incoming ACL to allow all and restart the cupc client for changes to take place..

Thanks

Shahrukh Qureshi

[fieryhail]

Yes, the ACLs are set to all.

[Jonathan Schulenberg]

I disagree with this recommendation. Incoming ACLs disables authentication for the SIP Proxy. This would allow impersonation of any user by any SIP SIMPLE-compliant client. I would strongly suggest you assign the users a Digest Password instead. Any random value will do, the user never needs to know it with CUPC.