Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

CUCM 7.0.2.20000-5 and LDAP synchronization issue

Hello.

We have a CUCM 7.0.2.20000-5, integrated with an LDAP.

We have deleted a user from LDAP and performed the re-synchronization on the CUCM, and the user is still present on CUCM itself, but as Inactive.

We have tried to follow the instructions present in this link:

http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_tech_note09186a0080b14d18.shtml

i.e., we have both restarted Cisco DirSync service, and issued the "run sql select * from DirectoryPluginConfig" from CLI, but the string "54c43f99-a561-4f3a-868d-26a5547445d9 " is present in its outuput; then, we shouldn't open a case with the TAC Service Request Tool, as mentioned in step 4! ;-)

So, what's wrong?

Thanks in advance for your help.

Best regards.

  • IP Telephony
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Super Bronze

Re: CUCM 7.0.2.20000-5 and LDAP synchronization issue

Nothing is wrong; it takes roughly 48 hours on average for an account to be removed.

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/directry.html#wp1045229

After the initial synchronization, the creation, deletion, or disablement of an account will propagate to Unified CM according to the timeline shown in Figure 16-7 and as described in the following steps:

1.     At 8:00 AM on January 1, an account is disabled or deleted in AD. From this time and during the whole period A, password authentication (for example, Unified CM User Options page) will fail for this user because Unified CM redirects authentication to AD. However, PIN authentication (for example, Extension Mobility login) will still succeed because the PIN is stored in the Unified CM database.

2.     The periodic re-synchronization is scheduled for 11:00 PM on January 1. During that process, Unified CM will verify all accounts. Any accounts that have been disabled or deleted from AD will at that time be tagged in the Unified CM database as inactive. After 11:00 PM on January 1, when the account is marked inactive, both the PIN and password authentication by Unified CM will fail.

3.     Garbage collection of accounts occurs daily at the fixed time of 3:15 AM. This process permanently deletes user information from the Unified CM database for any record that has been marked inactive for over 24 hours. In this example, the garbage collection that runs at 3:15 AM on January 2 does not delete the account because it has not been inactive for 24 hours yet, so the account is deleted at 3:15 AM on January 3. At that point, the user data is permanently deleted from Unified CM.

If an account has been created in AD at the beginning of period A, it will be imported to Unified CM at the periodic re-synchronization that occurs at the beginning of period B and will immediately be active on Unified CM.

Please remember to rate helpful responses and identify helpful or
2 REPLIES
VIP Super Bronze

Re: CUCM 7.0.2.20000-5 and LDAP synchronization issue

Nothing is wrong; it takes roughly 48 hours on average for an account to be removed.

http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/srnd/8x/directry.html#wp1045229

After the initial synchronization, the creation, deletion, or disablement of an account will propagate to Unified CM according to the timeline shown in Figure 16-7 and as described in the following steps:

1.     At 8:00 AM on January 1, an account is disabled or deleted in AD. From this time and during the whole period A, password authentication (for example, Unified CM User Options page) will fail for this user because Unified CM redirects authentication to AD. However, PIN authentication (for example, Extension Mobility login) will still succeed because the PIN is stored in the Unified CM database.

2.     The periodic re-synchronization is scheduled for 11:00 PM on January 1. During that process, Unified CM will verify all accounts. Any accounts that have been disabled or deleted from AD will at that time be tagged in the Unified CM database as inactive. After 11:00 PM on January 1, when the account is marked inactive, both the PIN and password authentication by Unified CM will fail.

3.     Garbage collection of accounts occurs daily at the fixed time of 3:15 AM. This process permanently deletes user information from the Unified CM database for any record that has been marked inactive for over 24 hours. In this example, the garbage collection that runs at 3:15 AM on January 2 does not delete the account because it has not been inactive for 24 hours yet, so the account is deleted at 3:15 AM on January 3. At that point, the user data is permanently deleted from Unified CM.

If an account has been created in AD at the beginning of period A, it will be imported to Unified CM at the periodic re-synchronization that occurs at the beginning of period B and will immediately be active on Unified CM.

Please remember to rate helpful responses and identify helpful or
New Member

Re: CUCM 7.0.2.20000-5 and LDAP synchronization issue

Dear Mr. Schulenberg,

thank you for your answer.

In fact, I have waited all the weekend, then I have checked again the presence of the account; it has been completely deleted.

Thanks again and best regards.

657
Views
0
Helpful
2
Replies