Set up LDAP for Authentication Only

This procedure sets up LDAP for authentication-only, in VOSS Automate.

Note

Users can be added locally or synced from Cisco Unified CM (CUCM):

LDAP authenticated, by default

  • Users that are LDAP synced in CUCM and then synced into VOSS Automate

By default, not LDAP authenticated

  • Users that are manually configured in CUCM and then synced into VOSS Automate

  • Users who are manually configured in VOSS Automate

You can change the default behavior, as described in View and Update LDAP Authentication Users.

LDAP for Authentication Only is available at hierarchy nodes that have an LDAP server; thus, it is not available for users created at the site level. When enabled, you must fill out the CUCM LDAP Directory Name for the LDAP server. If two or more LDAP server syncs have been created and you don’t provide this detail, no LDAP users are created, and the transaction log displays a warning message.

To set up LDAP for authentication-only:

  1. Log in as provider, reseller, or customer administrator.

  2. Set the hierarchy path to the node where you have set up the LDAP server you want to use to authenticate users.

  3. Choose LDAP Management > LDAP User Sync.

  4. Click Add.

  5. Fill out the relevant details:

Field

Description

LDAP Server

Choose the LDAP Server where you are authenticating users.

LDAP Authentication Only

Disabled by default. When disabled, users are synced from the configured LDAP directory and their passwords are authenticated against the configured LDAP directory. When enabled, the LDAP server is used only to authenticate users.

When selected:

  • The CUCM LDAP Directory Name for the LDAP server must be filled in. When more than one LDAP server sync is created and this is not filled in, no LDAP users will be created and a warning message will be seen in the transaction log.

  • Users are not synced from the configured LDAP directory, but their passwords are authenticated against the LDAP directory.

  • You can manually add users from the GUI or API, bulk load them, or sync them from Unified CM.

User Model Type

Read-only. Identifies the LDAP object (defined in the configured LDAP server), used to authenticate users.

LDAP Authentication Attribute

Choose the LDAP Attribute to be used to authenticate users. This field is mandatory. Options are:

  • sAMAccountName - AD only, this is the default for AD.

  • uid - OpenLDAP only, this is the default for OpenLDAP.

  • mail

  • employeeNumber

  • telephoneNumber

  • userPrincipalName - AD or hybrid (with MS)

These are the same values Unified CM users for LDAP Attribute for User ID.

AD (Active Directory) only:

For the following types of users, do not select userPrincipalName, unless the userPrincipalName value was set as the Username when the user was created:

  • Users created using the VOSS Automate GUI

  • Users created using the VOSS Automate API

  • Users bulk loaded into VOSS Automate

  • Users manually created in Unified CM and synced into VOSS Automate

For users synced from LDAP into Unified CM and then into VOSS Automate:

Caveats (AD and OpenLDAP)

For users synced from LDAP into Unified CM and then into VOSS Automate:

  • We strongly recommend selecting the same LDAP Authentication Attribute as Unified CM uses for LDAP Attribute for User ID.

  • If you sync users into Unified CM using attributes other than sAMAccountName/uid, do not choose sAMAccountName/uid.

If you sync users from LDAP into CUCM using employeeNumber, choose employeeNumber for the LDAP Authentication Attribute. However, to get the LDAP Authentication to work properly, one of these conditions must be met:

  • Before syncing users from CUCM to VOSS Automate, set the Employee Number field on CUCM Server FieldMapping tab to userid

  • Define the LDAP for Authentication Only sync before syncing users from CUCM into VOSS Automate

  1. Click Save.

    All users that have SyncToHierarchy set to the hierarchy of the LDAP server now use the LDAP server for authentication. The users are added to the LDAP Authentication Users list.

previous

LDAP Schedule

next

View and Update LDAP Authentication Users