Here is a 'canned' answer I found on an internal Cisco posting to the same question, plus a possible solution using Unity -
CallManager 4.x and 5.x do not natively support DISA. It is too much of a security risk for toll fraud without some method to authenticate callers. The options to enable DISA-like functionality in a CCM environment are:
1) Remote System Access feature of Cisco Mobility Manager solution - available today
The System Remote Access feature requires "H.323 Hairpinning" which makes use
of the VXML application for authentication of caller identity. This can only be used by a matching Dial-peer. MGCP does not allow access to VXML dial-peers to do Remote Access functions.
The "H.323 hairpin" option as described in the Installation Guide:
http://www.cisco.com/en/US/customer/products/ps6567/products_installation_guide_chapter09186a0080645bc0.html#wp1135473
2) Wait for a future CallManager release where this feature will be available
natively.
3) You can configure IP Contact Center (IPCC) software in conjunction with
Cisco CallManager in order to achieve this
functionality.
Some other alternatives are creating custom TCL scripts on a router, where the router is able to perform the intended functions.
The Unity system transfers feature will allow you to have a DISA functionality.
This was introduced with Unity 4.0(4)
http://www.cisco.com/en/US/partner/docs/voice_ip_comm/unity/404/release/note/cu404rn.html#wp118261
You can have the users call into a Unity system and route them to the subscriber system transfer conversation. This will force them to validate their ID and will use the subscribers restriction table to
define what numbers they can dial out to.
