Mark Holloway

When completing a fresh installation of CUCM it will use its own embedded LDAP directory to store End User information. In most cases it is preferred to integrate CUCM with a corporate LDAP directory such as Micrsoft Active Directory rather than managing two separate user databases. This becomes even more apparent when there are multiple CUCM clusters as they can share the same corporate directory.

Step 1 – In CUCM Serviceability > Tools > Service Activation the Cisco DirSync box must be checked and the service Activated.

Step 2 – Go to Cisco Unified CM Administration > System > LDAP > LDAP System to identify what type of LDAP system to synchronize with and how to reference the users. Enable Synchronizing from LDAP Server must be checked. The attribute sAMAccountName refers to the logon name for the domain.

Step 3 – Click on System > LDAP > LDAP Directory and click Add New. In this example the Active Directory domain in my lab is ccie.local and the IP address of the Domain controller is 142.100.64.18. The LDAP Manager Distinguished Name in this case is the default Windows system administrator account for my domain (administrator) but best-practice in a production deployment would be to use an isolated user account different than the default administrator account so it’s setup specifically for CUCM and Active Directory integration.  The LDAP User Search Base uses two attributes to make up a dn (distinguished name). This includes the cn (common name) and the dc (domain component). The rules of LDAP define the most significant part of the distinguished name is furthest to the right.  In this case it is dc=local. The last thing to note for this step is that synchronization occurs once per day at 6:00 AM. The smallest window of time to synchronize is six hours.

Step 4 – Click on System > LDAP > LDAP Authentication. This will authenticate CUCM End Users using Active Directory instead of the embedded CUCM directory.

At this point CUCM should be ready to synchronize with Active Directory. Before doing this, note that any End Users on the CUCM cluster that do not exist in Active Directory will be set to Inactive.  For example, I had user HQ4 created prior to configuring LDAP.  After configuring LDAP the user appears as Inactive under the End User listing. I went to my Windows 2008 Server and added user HQ4 to the domain ccie.local and the user is now active.

Click on System > LDAP > LDAP Directory then click Perform Full Sync Now

I have a total of six users in my Active Directory. Prior to performing the synchronization step in CUCM I had one End User called HQ4 that was managed locally using CUCM’s embedded LDAP directory.  I proceeded to create users HQ1, HQ2, HQ3, HQ4, SITEB1, and SITEB2 in Active Directory without having them present in CUCM (except for HQ4).

After performing the synchronization the users which were created in Active Directory are now appearing in the CUCM End User list and LDAP Sync status is showing Active.

Take note that when clicking on an End User the display of information is different compared to using the embedded database.

The following is a screenshot of the Active Directory Server Users.

A similar procedure as the one just discussed may be used to integrate Unity Connection with Microsoft Active Directory using the LDAP menu options under System Settings.

Configure LDAP Setup, LDAP Directory, and LDAP Authentication and enter the same the information used for the CUCM LDAP configuration.  You will want to set LDAP to sync with Active Directory at least once per day.

Next in Unity Connection click Import to import users. Note that in versions earlier than Unity Connection 8 the Import option is at the bottom of the page under Tools.

In the drop down list select LDAP Directory. The phone number associated in the “Telephone Number” field in Active Directory will be the extension that is populated in Unity Connection for the user. This is the same field from Active Directory that CUCM uses to populate the number for the End User.

One very important step after selecting LDAP Directory and clicking Find is to change the default selection administratortemplate to the voicemailusertemplate (or whatever custom template my be preferred). If the default admin template is used then users will be imported as Administrators and they will not have a mailbox assigned.

The users listed above were retrieved from Active Directory and have been imported into Unity Connection.

If the users that were imported do not reside in the default timezone of the Unity Connection system you will want to go into each user and change the timezone. Otherwise voice mail timestamps will be incorrect.

This concludes CUCM and Unity Connection integration with Active Directory.