CRS 4.0(1) Installation fails when using AD for LDAP

[gayshan]

I've encountered the following error, "Error while acquiring LDAP lock" when the installation is creating the cluster profile in a Win 2003 server AD. The intented IP-IVR is currently in a workgroup as stated in the installation guide, and I've already applied the 2000-4-3a OS upgrade. The install guide states that the error is caused by the cluster being locked by another user. But I've made sure that no one is logged on the AD server during the installation. Appreciate it if someone can give some clues to work around this problem. Thanks.

[wong34539]

Try this way - Right click on the Locks.xxxxxxx, and select New ->ciscoCCNocConfigInfoCES

Enter the name as "lockApplicant?empty" and press Enter In the next window, click on the Add button and in the Enter String value box, enter "x" and click OK

[jawilson_1]

When you say 'Right click...', do you mean to right click on the message while in the CRS Admin webpage where the error message would show?

[gayshan]

I've managed to figure out how to get CRS to work with AD. There are basically 2 ways to get this done.

If the CRS is a new installation, and CCM is using DC for LDAP, there is no way you could use AD. Therefore, the first way is to migrate CCM's LDAP from DC to AD first, then proceed with the with CRS installation. Only then it'll be able to use AD as LDAP.

If you do not want to migrate CCM's LDAP to AD yet, the second way is to install CRS with DC first. After that, perform the CRS's LDAP migration from DC to AD.

[VodnevEgor_2]

I've got the same problem, when trying to install CRS 4.0.1

CCM5.0.3 migrated to AD, but it not solved the issue.

CalInstall.log:

resolve() i=8, sN[i]=dc=lab, sParent=

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=7, sN[i]=dc=ibm, sParent=dc=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() domain found: dc=ibm,dc=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=6, sN[i]=ou=cisco, sParent=dc=ibm,dc=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=5, sN[i]=ou=CCN Apps, sParent=OU=cisco,DC=ibm,DC=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=4, sN[i]=ou=clusters, sParent=OU=CCN Apps,OU=cisco,DC=ibm,DC=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=3, sN[i]=ou=IPCC, sParent=OU=clusters,OU=CCN Apps,OU=cisco,DC=ibm,DC=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=2, sN[i]=ou=Locks, sParent=OU=IPCC,OU=clusters,OU=CCN Apps,OU=cisco,DC=ibm,DC=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() i=1, sN[i]=ou=Locks, sParent=OU=Locks,OU=IPCC,OU=clusters,OU=CCN Apps,OU=cisco,DC=ibm,DC=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() ou missing: ou=Locks,OU=Locks,OU=IPCC,OU=clusters,OU=CCN Apps,OU=cisco,DC=ibm,DC=lab: csco_clss::LdapConnection::search() ldap_search_s operation failed {No Such Object: 32}

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::getNonBinaryValue() about to get string ciscoCCNatConfigInfoCISValueMulti under cn=Locks,OU=Locks,OU=IPCC,OU=clusters,OU=CCN Apps,OU=cisco,DC=ibm,DC=lab

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::resolve() ConfigObject cis missing: cn=Locks,OU=Locks,OU=IPCC,OU=clusters,OU=CCN Apps,OU=cisco,DC=ibm,DC=lab: csco_clss::LdapConnection::search() ldap_search_s operation failed {No Such Object: 32}

CSCO:Fri Dec 21 14:16:17 2007:csco_clss::LdapConnection::~LdapConnection() unbinding from ldap

CSCO:Fri Dec 21 14:16:17 2007:csco_eftn::LockAcquire() exception:csco_clss::LdapConnection::resolve() unable to resolve dn because an ou was missing.

CSCO:Fri Dec 21 14:16:17 2007:csco_eftn::LockAcquire() out: nReturn=80, sLckUsageDesc=Error in LockAcquire()

[Riccardo Bua]

Hi there,

locks error are most likely tied to a known DDTS, CSCsd13553.

The AD workaround is the following:

1. IPCC Express should have primary NIC listed first in the binding

order if you have 2 NIC cards on server.

2. On AD server, please run ADSI tool and perform following:

Browse to CCN Apps -> clusters -> [profile] -> Locks -> Locks.00000

Check and chang the Lock entries to:

lockApplicant?empty

lockOwner?empty

lockUsage?empty,

lockUserInfo?empty

lockUserTimestamp?empty

(ignore lockExpiration)

In the properties of each lock check that ciscoCCNocConfigInfoCESValueMulti

values set to

"x".

Also add the lockOwner?empty by:

- Right click on the Locks.xxxxxxx, and select New ->

ciscoCCNocConfigInfoCES

- Enter the name as "lockOwner?empty" and press Enter

- In the next window, click on the Add button and in the Enter String value

box, enter "x"

and click OK

Regards,

Riccardo

PS Please rate useful posts accordingly.

[VodnevEgor_2]

Thank you for your answer.

I already read this in Cisco manual. The problem is that I don't have folder - Locks.00000, and also don't have ciscoCCNocConfigInfoCES object type and ciscoCCNocConfigInfoCESValueMulti value.

IPCCE NIC is primary.

[mhchoo_121]

I'm having the same problem as VodnevEgor. There are no objects available under the Locks folder.

I'm currently trying to install CRS 4.0(1) by using AD to create a cluster profile. The Call Manager version is 6.12 which was integrated with AD.

[Kapil Atrish]

HI Gayshan,

I've CCM 6 with AD integration. I've CRS 7 which I've pointed to CCM. Do I need to point the CRS to AD as well, or I am safe with current scenario, any inputs.

My problem is that I am trying to use IPPA, I always get Password Not correct kind of message on phone. I've tried both PIN and Password what is mentioned inside CCM end-user option but no good. I am not using LDAP authentication,hence I am resetting PIN and password on ccm.

Strange thing is when I use CAD, I am able to login with same Agent, take calls etc but same agent not able to login through IPPA.

thanks in advance,

inner_silence

[gayshan]

I haven't got the opportunity to deploy CCM6 + CRS7 at this point of time, so i'm really sorry i can't be of much help.

But based on my readings, I'm guessing that IPPA's authentication is controlled by CRS, instead of CCM, since it's an alternative login method to CAD. I may be wrong...:/