CUCM Directory Synchronization FAQ

Size: px

Start display at page:

Download "CUCM Directory Synchronization FAQ"

Raymond Peters
6 years ago
Views:

1 1 sur 6 04/07/ :10 CUCM Directory Synchronization FAQ From DocWiki Back to Unified Communications FAQ Back to CUCM FAQ Contents 1 How many users can I have in my CUCM?? 2 How many LDAP search bases can I configure?? 3 What LDAP directories are supported?? 4 Can I do a multi-forest LDAP integration?? 5 Can I sync my PIN to LDAP?? 6 I need to change my LDAP integration to another domain, how should I do it?? 7 How can I turn my LDAP synced users into local users?? 8 What can I use the custom LDAP fields for?? 9 Can I sync a Security Group into CUCM?? 10 I'm going to change from LDAP to LDS / ADAM and need to change the userid, how can I do that?? How many users can I have in my CUCM?? The maximum number of users that a Unified CM cluster can handle is limited by the maximum size of the internal configuration database that gets replicated between the cluster members. The maximum number of users that can be configured or synchronized is 160,000. Directory Integration and Identity Management ( /cucm/srnd/collab10/collab10/directry.html) How many LDAP search bases can I configure?? The maximum number of users that a Unified CM cluster can handle is limited by the maximum size of the internal configuration database that gets replicated between the cluster members. The maximum number of users that can be configured or synchronized is 160,000. With more than 80,000 users the maximum number of LDAP synchronization agreements is limited to 10, while with less than 80,000 users the total number of LDAP synchronization agreements is limited to 20. Directory Integration and Identity Management ( /cucm/srnd/collab10/collab10/directry.html) What LDAP directories are supported??

2 2 sur 6 04/07/ :10 This one I'm not sure why they changed some options from the list, originally the 10.x system guide showed: Configure LDAP Directory If you want to do so, you can add users from your corporate directory to the Cisco Unified Communications Manager database by synchronizing the user data to the database. Cisco Unified Communications Manager allows synchronization from the following directories to the database: Microsoft Active Directory 2003 R1/R2 (32-bit) Microsoft Active Directory 2008 R1(32-bit)/R2(64-bit) Microsoft Active Directory Application Mode 2003 R1/R2 (32-bit) Microsoft Active Directory 2012 Microsoft Lightweight Directory Services 2008 R1(32-bit)/R2(64-bit) Microsoft Lightweight Directory Services 2012 Sun ONE Directory Server 7.0 OpenLDAP OpenLDAP 2.4 Oracle Directory Server Enterprise Edition 11gR1 And the current page shows: Configure LDAP Directory ( /ccmsys/cucm_bk_se5fcfb6_00_cucm-system-guide-100/cucm_bk_se5fcfb6_00_cucm-systemguide-100_chapter_ html#cucm_tk_c4e65231_00) If you want to do so, you can add users from your corporate directory to the Cisco Unified Communications Manager database by synchronizing the user data to the database. Cisco Unified Communications Manager allows synchronization from the following directories to the database: Microsoft Active Directory 2003 R1/R2 (32-bit) Microsoft Active Directory 2008 R1(32-bit)/R2(64-bit) Microsoft Active Directory Application Mode 2003 R1/R2 (32-bit) Microsoft Lightweight Directory Services 2008 R1(32-bit)/R2(64-bit) Sun ONE Directory Server 7.0 OpenLDAP OpenLDAP 2.4 Oracle Directory Server Enterprise Edition 11gR1 AFAIK, the first one is correct, and CUCM 10.x DOES support AD 2012 Can I do a multi-forest LDAP integration?? Yes, carefully review: Unified CM Multi-Forest LDAP Synchronization ( /voice_ip_comm/cucm/srnd/collab10/collab10/directry.html#pgfid ) How to Configure Unified Communications Manager Directory Integration in a Multi-Forest Environment (

3 3 sur 6 04/07/ :10 Can I sync my PIN to LDAP?? No, the PIN is something that has only local significance to CUCM and you cannot configure it to be synced against anything I need to change my LDAP integration to another domain, how should I do it?? The procedure is really straight-forward, basically you delete your current LDAP sync and authorization agreements, and re-create them, pointing to the new domain and search bases. Notice that CUCM will follow the regular procedure for the garbage collector ( /voice_ip_comm/cucm/srnd/collab10/collab10/directry.html#pgfid ) once you change the LDAP sync agreements if the userid that CUCM has, does not match the ones in LDAP. How can I turn my LDAP synced users into local users?? This method was mainly used for pre 9.x CUCM when you could only have, all LDAP, or all local users, and you wanted to disable the LDAP sync for whatever reason, which would turn all users into inactive users. Not so useful for 9.x+ since you can have both, LDAP and local, users at the same time. You'll need some queries for this: run sql update enduser set status=1 If any user became inactive, the above query will change the status to active. You would want to do this in small batches to avoid issues, You can use any condition you want from the enduser table to do that, this example updates users with DN starting with 2 run sql update enduser set status=1 where telephonenumber like 2% Once you're done updating the users, you can make sure all of them are now local users run sql select * from enduser where status=0 You should get 0 results if all of your users are now local users. If you do get a result from the query, you can run the query again, against those users. UPDATE 7/1/16 Someone recently posted another method to do this and I wanted to test it, I had one test user which was LDAP integrated, and another one, very similar but was local and ran a query to compare them (I'm only showing a few fields from enduser table): pkid firstname middlename lastname userid telephonenumber tkuserlocale status ==================================== ========= ========== ======== ====== =============== ============ ======

4 4 sur 6 04/07/ : f8-ba93-30c8-b525-dc286f2d26f8 Jane Doe jadoe pkid firstname middlename lastname userid telephonenumber tkuserlocale status ==================================== ========= ========== ======== ====== =============== ============ ====== ec2f2388-e2fe-55cb-a4ce-575b1ce266ef Jane Doe1 jadoe1 NULL 1 The query that was mentioned, was this: run sql update enduser set fkdirectorypluginconfig=null where userid = 'jadoe' After I ran que query, I refreshed the GUI, and user jadoe was now a local user, this seems to be the preferred method now if you need to turn LDAP users into local users in bulk. According to the 10.5 data dictionary ( /UCM10.5DataDictionary.htm#enduser), that is the field that determines if the user is LDAP integrated, or not, and thus prevents changes to the users. The above method will work on 10.x and 11.x as I confirmed the fields are the same. What can I use the custom LDAP fields for?? CUCM has absolutely no use for any of them, no process will look into them, these are mainly used for other applications like the Attendant Consoles which look at CUCM as the directory sources, and then you can map those within the app. Can I sync a Security Group into CUCM?? For a long time, I always saw the answer was no, however, someone did that, and showed me I was wrong, it seems all it takes is to adjust the LDAP filter that is used to something like: (&(objectcategory=user)(memberof=cn=securitygroupname,ou=abc,dc=def,dc=com)) It seems to work, but I have not tested it nor know if this is officially supported, use with caution. I'm going to change from LDAP to LDS / ADAM and need to change the userid, how can I do that?? This is a question that I've received plenty of times, and want to try to address it as clearly as possible. This might also be applicable if you're moving to a new domain, and that means the value for the userid will be changed. The fields that you can use for userid will change depending on the directory option you use, and some of them will not be available if you need to change that option. on 9.x+ you can have local and LDAP users at the same time, on previous releases it was either all local, or all LDAP. Now, if you're syncing against LDAP 2012, and you're currently using samaccountname for userid and

5 5 sur 6 04/07/ :10 you are required to change and use mail, you need to use LDS and use UPN, you're going to use a new domain in which the samaccountname is still going to be used but the values do not match between old and new domain, etc. All of those are examples of when you might face this. The users will only remain as Active LDAP Synchronized Users as long as they have an EXACT match in LDAP for the current value you have as userid. This means that changing it on LDAP, even if you don't change anything in the LDAP config in CUCM, would have the same effect. We'll use John Doe as an example. samaccountname = jodoe mail = john.doe@company.com UPN = john.doe@company.com If you're currently using samaccountname and your directory admin choose to change from jodoe to john.doe, after the change is done, and the LDAP sync is performed, the user will show as an inactive LDAP user, and will be deleted by the garbage disposal mechanism after the required time has passed. At the same time, a NEW user will be created, with userid john.doe (if you have a Feature Group Template some info will be retained). But for all matter of purposes, this will be a new user, and you will need to add again any roles, user / device / line association, remote destinations, etc. In order the avoid user duplication that happens on the above scenario, you need to fix this BEFORE the change. This is applicable to any of the previous scenarios I've mentioned. 1. You need to be aware of what the change will be 2. Once you have that information, you need to get the value for the new userid for all the users 3. Turn all your LDAP users into local users (see How can I turn my LDAP synced users into local users??) 4. As applicable (this will depend on the exact change, ultimately the goal is to disable the LDAP sync): 1. Delete the old LDAP sync agreement 2. Disable LDAP 5. Now all of the users should show as Enabled Local User 6. You will need to manually, or using BAT, change the current userid value, to that of the new userid value 7. Once this has been done for all the users, you will proceed to configure the new LDAP integration, or just enable LDAP again, depending on the scenario 8. As you perform the full sync, the existing userid in CUCM should be an exact match against the LDAP field, and the users will now show as Active LDAP Synchronized User 9. Confirm all the user settings, such as PIN remain the same. It's very important to consider that while you do this, you'll have to disable not only the LDAP sync, but also the LDAP authentication. This can cause trouble for the users if the try to login into Self-Care Portal, CUCMadmin, etc. I'd strongly recommend to do this off-hours so users do not get affected. Back to Unified Communications FAQ Back to CUCM FAQ Contact: Any comments, questions, suggestions, contributions, etc. please send them to javalenc@cisco.com (mailto:javalenc@cisco.com). Please make sure the subject is formatted "UC FAQ <anything else>" as I'll have rules in my mail to match them, otherwise, they'll end up in my spam folder.

6 6 sur 6 04/07/ :10 Rating: 5.0/5 (3 votes cast) Related Discussions from the Cisco Support Community Sorry you have encountered a temporary system error. Retrieved from "" This page was last modified on 1 July 2016, at 18: Cisco Systems, Inc. All rights reserved. Trademarks

Import Users From LDAP Directory

Import Users From LDAP Directory LDAP Synchronization Overview, page 1 LDAP Synchronization Prerequisites, page 3 LDAP Synchronization Configuration Task Flow, page 3 LDAP Synchronization Overview Lightweight Directory Access Protocol