Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Impossible to create LDAP SYNC user on CUCM with Prime Collab Provisioning

Hello,

Previously, I use Prime Provisionning to create and provision services for static users, it works.

For the same Customer, CUCM and Unity user are now imported from LDAP.
I add the changes in Provisioning processors (LDAP Auth + Sync).

At this time, it's impossible to create new users on CUCM from Provisioning !

Here is my procedure :

- I do a LDAP sync on prime to detect my new AD user.
- I select it and provision services to push on CUCM
- Orders stuck in being provisioned state...

On the CUCM, the user doesn't appear at all.

Is something wrong in my method ?

Do I need to make a LDAP sync on the CUCM to import users, next user synchro on processor in Prime, then edit user ?

Thanks

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Clement,I suspect you have

Clement,

I suspect you have LDAP sync turned on in CUCM. If CUCM is set to sync and does not already have the userID in it's database it will reject a user add.

This is a recognized problem with having both products set to sync. There are some solutions:

  1. Always sync CUCM before you sync Prime Collaboration Provisioning (PCP).  This way the new user will already be in CUCM and then will accept a provisioning order from PCP.  The frequency of LDAP sync on CUCM will determine how often PCP can push new users to CUCM.
  2. If PCP tries to provision a user but it is rejected by CUCM, provisioning will attempt to send it for 24 hours. There is an assumption that CUCM will sync daily so at some point CUCM will get the userID and then when PCP tries to provision, it will be accepted.
  3. Use the latest CUCM 10.5(x) with a patch that provides the Authenticate Only setting setting. You will have to check with TAC or CUCM Marketing/TMEs for more information.  In this case, CUCM will authenticate admins and Jabber clients against AD, but will take users from PCP immediately.  The CUCM eng/marketing team has recommended we move away from syncing CUCM when PCP is doing the syncing from AD. CUCM does not need to sync when PCP is present. This eliminates the race condition between which app synced first.

Regards

6 REPLIES
Cisco Employee

Clement,I suspect you have

Clement,

I suspect you have LDAP sync turned on in CUCM. If CUCM is set to sync and does not already have the userID in it's database it will reject a user add.

This is a recognized problem with having both products set to sync. There are some solutions:

  1. Always sync CUCM before you sync Prime Collaboration Provisioning (PCP).  This way the new user will already be in CUCM and then will accept a provisioning order from PCP.  The frequency of LDAP sync on CUCM will determine how often PCP can push new users to CUCM.
  2. If PCP tries to provision a user but it is rejected by CUCM, provisioning will attempt to send it for 24 hours. There is an assumption that CUCM will sync daily so at some point CUCM will get the userID and then when PCP tries to provision, it will be accepted.
  3. Use the latest CUCM 10.5(x) with a patch that provides the Authenticate Only setting setting. You will have to check with TAC or CUCM Marketing/TMEs for more information.  In this case, CUCM will authenticate admins and Jabber clients against AD, but will take users from PCP immediately.  The CUCM eng/marketing team has recommended we move away from syncing CUCM when PCP is doing the syncing from AD. CUCM does not need to sync when PCP is present. This eliminates the race condition between which app synced first.

Regards

New Member

Hi,Thank you for this answer

Hi,

Thank you for this answer.
So I decided to contact TAC to get the better solution.

I suppose this is the reason why when you create a LDAP directory on CUCM 10.5, you have an information message that say DirSync service may be disabled if CUCM is used in combination with Prime.

Clement

VIP Purple

Hi Clement, Can u share the

Hi Clement,

 

Can u share the findings of TAC ?

[+5] to Tony.

 

regds,

aman

New Member

Hi Aman,I didn't contact the

Hi Aman,

I didn't contact the TAC, as I use the 1st solution proposed by Anthony.

If the customer need to provision an user immediately, I advice him to make manual sync in CUCM, next manual sync in Unity, next manual sync in PCP, then provision services.

Otherwise, he provision users only in PCP, as I set lowest time (6 hours) for the LDAP sync on both Unity and CUCM.

Some other bugs in PCP during provision (checkboxes not checked on the line call forwards, problems to integrate/associate user/line for presence in Jabber, etc...) make me wait for 10.6

New Member

I do not understand why the

I do not understand why the product works this way since a 10.x deployment of CUCM is allowed to have both local end users and ldap synchronized users. The problem here is that you cannot even create a static user for a lobby phone in PCP and add to CUCM.

New Member

Lobby phones are going to be

Lobby phones are going to be a part of the 'pseudo' user role unless they have a specific user tied to that phone. Pseudo users are not synchronized with CUCM. 

822
Views
10
Helpful
6
Replies