WarmTransfer
Configuration · guide

Setting up LDAP directory sync and authentication in Unified CM

Verified 2026-09-30 · 68 sources · tier 2

For Unified CM administrators configuring directory synchronization and authentication with an LDAP directory administrator.

During LDAP synchronization, Unified CM imports users and their user data from an external LDAP directory into the Unified CM database on a schedule to keep data current 59. Enabling LDAP authentication points end user password checks to the external LDAP directory instead of the local database 7.

Before you start

Before starting, complete the prerequisite groundwork across Cisco Unified CM and the external LDAP directory 51:

  • Check that your directory appears in the Release 15x compatibility matrix: Microsoft Active Directory on Windows Server 2016, 2019, and 2022; Microsoft Lightweight Directory Services 2019 and 2022; Oracle Unified Directory 12cPS4; OpenLDAP LTS Release 2.5.16; or another LDAPv3-compliant directory 55.
  • Verify network firewalls permit TCP destination ports 389, 636, 3268, and 3269 from Unified CM to the external directory server 50.
  • Confirm that the email ID fields on Active Directory for users to be synchronized are unique entries or left blank 23.
  • Confirm that the directory server does not demand mutual TLS, as Unified CM does not support mutual TLS for LDAP connections with Active Directory and the handshake might fail if a client certificate is requested 45.
  • Note that after the initial synchronization has run, new users can still sync, but new configurations such as a feature group template cannot be added to that agreement 46. Subsequent configuration adjustments require the Bulk Administration Tool or creating a new agreement 12.

What changes by situation

Pick your answers to see only your path. Nothing is sent anywhere until you make a plan.

Which kind of LDAP directory are you syncing from?
Should synced users get a primary extension automatically during import?
Will Unified CM reach the directory over LDAPS?
Where should end user passwords be checked?

Four questions. One permanent page you can send to your manager.

Step 1 Prepare user access, default credentials, and provisioning templates

Yes, create each user's primary extension during the sync

Do

Complete Cisco's prerequisite tasks by configuring user access, setting default credentials, and building provisioning templates 51.

Go to User Management > User Settings > Credential Policy Default and establish default credentials separately for application user passwords, end user passwords, and end user PINs 14. Navigate to User Management > User/Phone Add > Universal Line Template and configure common settings applied to provisioned extensions 62. Navigate to User Management > User/Phone Add > Universal Device Template and choose a device pool, device security profile, SIP profile, and phone button template 61. Go to User Management > User Settings > User Profile to create a user profile assigning the universal device template and universal line template 63. Go to User Management > User/Phone Add > Feature Group Template, configure Home Cluster and Enable User for Unified CM IM and Presence as needed, and select the configured service profile and user profile 25.

Verify

Suggested check: Open the configured feature group template and confirm the user profile references the universal line template.

Rollback

Templates do not affect user data until associated with an LDAP directory sync agreement 25.

No, import users only and assign lines and phones later

Do

Configure user access and default credentials as required prerequisites 51.

Navigate to User Management > User Settings > Credential Policy Default and establish default credentials for application user passwords, end user passwords, and end user PINs 14. If non-line settings such as Home Cluster, IM and Presence enablement, or service profiles must apply to imported accounts, create a feature group template under User Management > User/Phone Add > Feature Group Template 25. These settings apply only the first time a user is synchronized 24.

Verify

Suggested check: Open the access control group list and verify that the intended group for imported users exists.

Rollback

Configurations remain inactive until mapped to an agreement 25.

Step 2 Activate the Cisco DirSync service

Do

In Cisco Unified Serviceability, go to Tools > Service Activation, select the publisher node, select Cisco DirSync under Directory Services, and click Save 19.

Verify

In Cisco Unified Serviceability, open Tools > Control Center - Feature Services and verify that Cisco DirSync displays as activated and started 21.

Step 3 Configure directory trust and security certificates

Yes, LDAPS (TLS)

Do

Confirm with the directory administrator that Active Directory is serving LDAPS with CA-signed certificates meeting LDAPS specifications 34. Verify LDAPS operation from an external tool such as Ldp.exe by connecting to the directory FQDN on port 636 and port 3269 to inspect RootDSE data 38. In Cisco Unified OS Administration, browse to Security > Certificate Management and upload root and intermediate certificates as tomcat-trust and CallManager-trust across each Unified CM and IM and Presence publisher node, or install the LDAPS server certificate itself as tomcat-trust 11​36. Restart Cisco Tomcat across each node using the CLI command utils service restart Cisco Tomcat, and restart Cisco CTIManager on any nodes where it runs 40. Restart the Cisco DirSync service if users do not synchronize over the secure port following the Tomcat restart 20.

Verify

In Cisco Unified Serviceability, browse to Tools > Control Center - Feature Services and confirm Cisco DirSync is activated and started 21.

No, unencrypted LDAP

Do

Skip certificate trust configuration; Tomcat-Trust certificates are required specifically for LDAPS 11.

Verify

Suggested check: Confirm that unencrypted LDAP is available on the directory server.

Step 4 Enable LDAP directory synchronization and select server attributes

Microsoft Active Directory

Do

In Cisco Unified CM Administration, go to System > LDAP > LDAP System 33. Check Enable Synchronizing from LDAP Server 33. Under LDAP Server Type, select Microsoft Active Directory 54. Set the LDAP Attribute for User ID, which defaults to sAMAccountName for Microsoft Active Directory 3. If authenticating against a Global Catalog server later, avoid choosing employeeNumber unless it has been explicitly replicated to the Global Catalog 30. Click Save 33.

Verify

Confirm that the LDAP System configuration page saves successfully with synchronization enabled 33.

Rollback

Suggested rollback: Uncheck Enable Synchronizing from LDAP Server and save before running any sync agreements.

Another supported LDAP directory (OpenLDAP, Oracle Unified Directory, or generic LDAPv3)

Do

In Cisco Unified CM Administration, go to System > LDAP > LDAP System 33. Check Enable Synchronizing from LDAP Server 33. Under LDAP Server Type, select Generic Directory Server for any supported LDAP server type other than Microsoft Active Directory 54. Select the appropriate LDAP Attribute for User ID drop-down value and click Save 33.

Verify

Confirm that the LDAP System configuration page saves successfully with synchronization enabled 33.

Rollback

Suggested rollback: Uncheck Enable Synchronizing from LDAP Server and save before running any sync agreements.

Step 5 Optionally create an LDAP filter

Do

If synchronizing a subset of users, navigate to System > LDAP > LDAP Filter and click Add New 28. Enter an RFC 4515 compliant search filter enclosed in parentheses, containing at most 1024 UTF-8 characters 28.

Verify

Suggested check: Verify that the newly created filter is listed and selectable in the filter drop-down on the LDAP Directory page.

Rollback

Suggested rollback: Delete the unused custom LDAP filter from System > LDAP > LDAP Filter.

Step 6 Create the LDAP directory agreement

Do

In Cisco Unified CM Administration, navigate to System > LDAP > LDAP Directory and click Add New 17. Provide a unique LDAP Configuration Name, the LDAP Manager Distinguished Name (an account with read access to the directory), and its password 17. On Unified CM Release 15SU2, restrict this password to ASCII characters and no more than 32 characters 47. Enter the LDAP User Search Space 17. Under synchronization scope, choose Users Only or Users and Groups, and select a custom LDAP filter if one was created 64. Define the sync recurrence using the LDAP Directory Synchronization Schedule fields 52. In Standard User Fields to be Synchronized, map LDAP attributes to corresponding End User fields, map custom fields as necessary, and assign the LDAP attribute representing the primary directory URI for URI dialing 27. Click Add to Access Control Group, check the required groups for synced users, and click Add Selected 1. Ensure all required groups are added now, as users are inserted into access control groups only when a group is added to the agreement for the first time 2.

Verify

Suggested check: Review all connection, schedule, mapping, and group fields in the agreement window prior to proceeding.

Rollback

Suggested rollback: Cancel or delete the unsaved LDAP Directory configuration entry.

Step 7 Configure user provisioning options

Yes, create each user's primary extension during the sync

Do

In the Feature Group Template drop-down of the LDAP Directory window, select the prepared feature group template 26. To create lines from directory phone numbers, check Apply mask to synced telephone numbers to create a new line for inserted users and enter an extension mask (for example, mask 11XX creates extension 1145 from number 8889945) 43. Check Assign new line from the pool list if one was not created based on a synced LDAP telephone number and configure DN Pool Start and DN Pool End values 22. Optionally, select a device under Jabber Endpoint Provisioning (Cisco Dual Mode for Android [BOT], Cisco Dual Mode for iPhone [TCT], Cisco Jabber for Tablet [TAB], or Cisco Unified Client Services Framework [CSF]) 32. Optionally, enable Write back to LDAP to write the primary DN to LDAP attributes telephoneNumber, ipPhone, or mobile 67.

Verify

Suggested check: Verify that the Feature Group Template and DN pool ranges are populated in the agreement window.

Rollback

Settings cannot be modified on existing users after the initial sync, requiring the Bulk Administration Tool or a new agreement to change 12​24.

No, import users only and assign lines and phones later

Do

Leave unchecked Apply mask to synced telephone numbers to create a new line for inserted users and Assign new line from the pool list if one was not created based on a synced LDAP telephone number 43​22. If non-line defaults were defined in a feature group template, select it now from the Feature Group Template drop-down list 26​46. Plan to assign end-user devices following import via self-provisioning or manual assignment through Add New Phone or Move an Existing Phone 4.

Verify

Suggested check: Verify that line masking and DN pool selection remain disabled in the agreement form.

Rollback

Suggested rollback: Re-select desired template options prior to saving.

Step 8 Specify LDAP server host targets

Yes, LDAPS (TLS)

Do

In the LDAP Server Information section of the LDAP Directory page, enter the server FQDN and port 636 41. Check Use TLS 53. Use the FQDN matching the certificate CN, as Unified CM validates the FQDN against the CN; if an IP address is used, configure the CLI command utils ldap config ipaddr 37. Add up to 3 LDAP server hostnames for failover if needed 56.

Verify

Suggested check: Verify that Use TLS is checked and the secure port is specified next to the server FQDN.

No, unencrypted LDAP

Do

In the LDAP Server Information section of the LDAP Directory page, enter the directory hostname or IP address 53. Specify port 389 and leave Use TLS unchecked 15​53. Add up to 3 LDAP server hostnames for failover if needed 56.

Verify

Suggested check: Confirm that the standard port is set and Use TLS remains unchecked.

Step 9 Save the agreement and execute the initial synchronization

Do

Click Save on the LDAP Directory configuration window 17. Click Perform Full Sync Now to trigger synchronization immediately 29.

Verify

In Cisco Unified CM Administration, go to User Management > End User and verify that synchronized accounts appear in the database 66.

Rollback

Users deleted from the external LDAP directory are removed from Unified CM automatically after 24 hours 16. Individual synchronized accounts can be detached from directory management by clicking Convert to Local User in the End User Configuration window 13.

Step 10 Configure end user password authentication

Against the LDAP directory (LDAP authentication)

Do

Navigate to System > LDAP > LDAP Authentication 5. Check Use LDAP Authentication for End Users 5. Enter the LDAP Manager Distinguished Name, password, and LDAP User Search Base 5. On Release 15SU2, restrict the password to ASCII characters and at most 32 characters 47. Enter the LDAP server hostname or IP address, and check Use TLS if using LDAPS 5. For Active Directory LDAPS, configure port 3269 to prevent Jabber client timeouts, or use port 3268 for Global Catalog authentication across geographically distributed domain controllers 31​35. For non-Active Directory servers, use port 389 or port 636 with SSL 15. Click Save 5. Note that a single LDAP authentication agreement covers the entire cluster 8, and end user passwords can no longer be edited in Unified CM once enabled 49.

Verify

Suggested check: Check that the LDAP Authentication page shows Use LDAP Authentication for End Users checked and saved successfully.

Rollback

Suggested rollback: Uncheck Use LDAP Authentication for End Users in System > LDAP > LDAP Authentication and click Save.

Against the Unified CM database

Do

Bypass the LDAP Authentication configuration window 60. Passwords will continue to be validated against the Unified CM database using the default credential policy 7​14.

Verify

Suggested check: Confirm that Use LDAP Authentication for End Users remains unchecked under System > LDAP > LDAP Authentication.

Step 11 Validate user sign-in

Against the LDAP directory (LDAP authentication)

Do

Sign in to the Self Care Portal at https://<publisher address>/ccmuser using a synchronized end user account and its corporate directory password 65.

Verify

Confirm authentication succeeds via simple bind to the external directory 9. Verify the user's PIN remains functional against Unified CM database authentication, as PINs and application user passwords remain locally authenticated 7​9.

Against the Unified CM database

Do

Sign in to the Self Care Portal at https://<publisher address>/ccmuser using a synchronized user ID and the default Unified CM password configured in the Credential Policy Default 14​65.

Verify

Confirm that the user account exists in User Management > End User and authentication succeeds using the local database credential 14​66.

Step 12 Optionally customize DirSync service parameters

Do

Navigate to System > Service Parameters, select the publisher server, and choose the Cisco DirSync service 57. Adjust service parameters as required based on system defaults:

  • Maximum Number Of Agreements defaults to 20 56.
  • Maximum Number Of Hosts defaults to 3 56.
  • Retry Delay On Host Failure defaults to 5 seconds 58.
  • Retry Delay On HostList Failure defaults to 10 minutes 58.
  • LDAP Connection Timeout defaults to 5 seconds 58.
  • Delayed Sync Start time defaults to 5 minutes 58.

Verify

Suggested check: Verify that the modified parameters retain their configured values after clicking Save.

Rollback

Reset modified service parameters back to their listed system defaults 56​58.

Applicability

Applies to: Cisco Unified Communications Manager. Deployments: on-premises. Sources checked 2026-09-30. For clusters upgrading from Release 11.5(1)SU2 to Release 14SU3 or above, the LDAP authentication password must be re-entered manually 6. Specific restrictions requiring ASCII passwords under 32 characters apply specifically to Release 15SU2 47. Directory synchronization is also a mandatory prerequisite for deploying SAML SSO 68.

What remains uncertain

The specific directory permissions required by the LDAP Manager account on the directory server are not covered by the sources below. The granular schedule fields and shortest permissible sync interval are not covered by the sources below. The user ID attribute drop-down options for non-Active Directory servers and complete attribute field mapping lists are not covered by the sources below. System behavior when the DN pool runs out during user import is not covered by the sources below. End-user sign-in error states and timeout experiences when the directory is unreachable under LDAP authentication are not covered by the sources below. Configurations involving multi-forest topologies or Active Directory Lightweight Directory Services are not covered by the sources below.

See also

Configures

  • Cisco unified cm — A configuration guide for the LDAP synchronization and LDAP authentication features of Cisco Unified CM Release 15; reuses that topic's vocabulary and cites its SAML SSO prerequisite claim.

Referenced by

Sources

  1. 1
    Imported end users are assigned a common access control group in the LDAP Directory window by clicking Add to Access Control Group, checking the groups, and clicking Add Selected.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 8 · Checked 2026-09-30
  2. 2
    Synchronized users are inserted into the selected access control group only when an access control group is added to the LDAP directory for the first time; a group added later is not applied to already synchronized users by a full sync.
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · section: Assign LDAP Synchronized Users to an Access Control Group, Note at Step 7 · Checked 2026-09-30
  3. 3
    With Microsoft Active Directory, the default value of the LDAP Attribute for User ID is sAMAccountName.
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · chapter: Configure LDAP Directory; sentence beginning 'If you use Microsoft Active Directory' · Checked 2026-09-30
  4. 4
    After users are imported, an administrator can either enable self-provisioning so end users provision their own phones, or assign devices manually with the Add New Phone or Move an Existing Phone procedures.
    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users · section: Import an End User from LDAP, what to do next · Checked 2026-09-30
  5. 5
    LDAP authentication is configured at System > LDAP > LDAP Authentication by checking Use LDAP Authentication for End Users and entering the LDAP Manager Distinguished Name, its password, the LDAP User Search Base, the LDAP server hostname or IP address, and optionally Use TLS, then clicking Save.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Authentication, Steps 1-8 · Checked 2026-09-30
  6. 6
    When upgrading Unified CM from Release 11.5(1)SU2 to Release 14SU3 or above, the LDAP authentication password must be re-entered.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Authentication, Note after Step 4 · Checked 2026-09-30
  7. 7
    LDAP authentication makes Unified CM authenticate end user passwords against the LDAP directory instead of its own database; it does not apply to PINs or application user passwords.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Authentication, introduction · Checked 2026-09-30
  8. 8
    A single LDAP authentication agreement is defined for the entire Unified CM cluster.
    Preferred Architecture for Cisco Collaboration 12.x Enterprise On-Premises Deployments, CVD - Call Control · section: User Authentication with LDAP · Checked 2026-09-30
  9. 9
    With LDAP authentication enabled, passwords of users imported from LDAP are checked against the corporate directory by a simple bind, while passwords of local end users, application user passwords and end user PINs are checked against the Unified CM database.
    Preferred Architecture for Cisco Collaboration 12.x Enterprise On-Premises Deployments, CVD - Call Control · section: User Authentication with LDAP · Checked 2026-09-30
  10. 10
    When an LDAP sync includes a feature group template with universal line and device templates and a DN pool, the import automatically configures the end user and a primary extension.
    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users · section: Import an End User from LDAP · Checked 2026-09-30
  11. 11
    For LDAPS, the LDAP server certificate must be uploaded to Unified CM as a Tomcat-Trust certificate.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: LDAP Synchronization Overview · Checked 2026-09-30
  12. 12
    To change what an existing LDAP sync applies after the initial sync, Cisco's options are the Bulk Administration Tool (menus such as Update Users or Insert Users) or setting up a new LDAP sync.
    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users · section: Import an End User from LDAP · Checked 2026-09-30
  13. 13
    Fields of an LDAP-synchronized end user cannot be edited in the End User Configuration window unless the user is converted to a local user with the Convert to Local User button.
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · section: Convert LDAP Synchronized User to Local User · Checked 2026-09-30
  14. 14
    Default credentials for newly provisioned users are set at User Management > User Settings > Credential Policy Default, separately for application user passwords, end user passwords and end user PINs, and users must enter the default at their next login.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Provisioning Profiles · section: Configure Default Credential Policy · Checked 2026-09-30
  15. 15
    The default LDAP server port is 389; when SSL is enabled, port 636 is specified.
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · section: Configure LDAP Directory Sync; sentence 'The default port is 389' · Checked 2026-09-30
  16. 16
    Users deleted in LDAP are automatically removed from Unified CM after 24 hours.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Note after Step 16 · Checked 2026-09-30
  17. 17
    An LDAP directory sync is created at System > LDAP > LDAP Directory with Add New, and its connection fields are a unique LDAP Configuration Name, the LDAP Manager Distinguished Name (a user ID with access to the LDAP directory server), that account's password, and the LDAP User Search Space.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Steps 1-3 · Checked 2026-09-30
  18. 18
    Enterprise directory user search is a separate optional task configured at System > LDAP > LDAP Search by checking Enable user search to Enterprise Directory Server; its LDAP servers must be reachable from the subscriber nodes.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure Enterprise Directory User Search · Checked 2026-09-30
  19. 19
    The Cisco DirSync service is activated in Cisco Unified Serviceability at Tools > Service Activation: select the publisher node, select Cisco DirSync under Directory Services, and click Save.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Activate the Cisco DirSync Service · Checked 2026-09-30
  20. 20
    If users do not synchronize over the secure port after Cisco Tomcat has been restarted, the Cisco DirSync service must be restarted for synchronization to succeed.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Note after Step 14 · Checked 2026-09-30
  21. 21
    Whether Cisco DirSync is activated and started can be checked in Cisco Unified Serviceability at Tools > Control Center - Feature Services.
    Configure CUCM for Secure LDAP (LDAPS) · section: Verify and Install LDAPS Certificates, Step 4 · Checked 2026-09-30
  22. 22
    Checking 'Assign new line from the pool list if one was not created based on a synced LDAP telephone number' and entering DN Pool Start and DN Pool End assigns primary extensions from that range of directory numbers.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 11 · Checked 2026-09-30
  23. 23
    For users whose data will be synchronized, the email ID fields on the Active Directory server must be unique entries or left blank.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: LDAP Synchronization Prerequisites · Checked 2026-09-30
  24. 24
    End users are synced with the assigned feature group template only the first time, when the users are not yet present in Unified CM.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Note after Step 9 · Checked 2026-09-30
  25. 25
    A feature group template is created at User Management > User/Phone Add > Feature Group Template, where Home Cluster and Enable User for Unified CM IM and Presence are set and a service profile and user profile are selected; it is then associated with an LDAP directory sync to apply its settings to synchronized end users.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Provisioning Profiles · section: Configure a Feature Group Template · Checked 2026-09-30
  26. 26
    A feature group template is assigned to an LDAP directory sync by selecting it from the Feature Group Template drop-down list in the LDAP Directory window.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 9 · Checked 2026-09-30
  27. 27
    In the Standard User Fields to be Synchronized section an LDAP attribute is chosen for each End User field; custom user fields can be mapped in a separate section, and for URI dialing the LDAP attribute for the user's primary directory URI must be assigned.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Steps 5-7 · Checked 2026-09-30
  28. 28
    An optional LDAP filter is created at System > LDAP > LDAP Filter; the filter can contain at most 1024 UTF-8 characters, must be enclosed in parentheses, and must follow the LDAP search filter standard in RFC 4515.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Create an LDAP Filter · Checked 2026-09-30
  29. 29
    After saving the LDAP directory, clicking Perform Full Sync Now completes an LDAP sync immediately; otherwise the sync runs at the next scheduled time.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Steps 15-16 · Checked 2026-09-30
  30. 30
    An Active Directory Global Catalog does not carry the employeeNumber attribute by default, so a deployment that uses employeeNumber as the user ID must either authenticate against domain controllers or add employeeNumber to the Global Catalog.
    Preferred Architecture for Cisco Collaboration 12.x Enterprise On-Premises Deployments, CVD - Call Control · section: User Authentication with LDAP (Global Catalog discussion) · Checked 2026-09-30
  31. 31
    For Active Directory topologies with geographically distributed domain controllers where authentication against one domain controller may be too slow, Cisco's 12.x Preferred Architecture points the authentication agreement at a Global Catalog server by configuring LDAP port 3268.
    Preferred Architecture for Cisco Collaboration 12.x Enterprise On-Premises Deployments, CVD - Call Control · section: User Authentication with LDAP (Global Catalog discussion) · Checked 2026-09-30
  32. 32
    The optional Jabber Endpoint Provisioning section of the LDAP Directory window can auto-provision one of four Jabber device types: Cisco Dual Mode for Android (BOT), Cisco Dual Mode for iPhone (TCT), Cisco Jabber for Tablet (TAB), or Cisco Unified Client Services Framework (CSF).
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 12 · Checked 2026-09-30
  33. 33
    LDAP synchronization is enabled in Cisco Unified CM Administration at System > LDAP > LDAP System by checking Enable Synchronizing from LDAP Server, choosing the LDAP Server Type, choosing the LDAP Attribute for User ID, and clicking Save.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Enable LDAP Directory Synchronization, Steps 1-5 · Checked 2026-09-30
  34. 34
    Configuring Active Directory itself for LDAPS, including installing CA-signed certificates that meet the LDAPS requirements, is the Active Directory administrator's responsibility.
    Configure CUCM for Secure LDAP (LDAPS) · section: Background Information · Checked 2026-09-30
  35. 35
    Cisco's secure LDAP technote configures LDAP Authentication for Active Directory with the LDAPS server's FQDN, port 3269 and Use TLS checked, and recommends port 3269 for Jabber clients to avoid timeouts.
    Configure CUCM for Secure LDAP (LDAPS) · section: Configure Secure LDAP Authentication · Checked 2026-09-30
  36. 36
    For Active Directory LDAPS, the root and intermediate certificates behind the LDAPS server certificate are uploaded as tomcat-trust and CallManager-trust at Cisco Unified OS Administration > Security > Certificate Management on each CUCM and IM and Presence publisher node; alternatively the LDAPS server certificate itself can be installed as tomcat-trust.
    Configure CUCM for Secure LDAP (LDAPS) · section: Verify and Install LDAPS Certificates, Step 2 · Checked 2026-09-30
  37. 37
    CUCM 10.5(2)SU2, 9.1(2)SU3 and later verify the configured LDAP server FQDN against the certificate's CN; the CLI command 'utils ldap config ipaddr' is used when the server is configured by IP address.
    Configure CUCM for Secure LDAP (LDAPS) · section: Configure Secure LDAP Directory, Note after Step 1 · Checked 2026-09-30
  38. 38
    LDAPS on an Active Directory server is verified with Ldp.exe by connecting to the server's FQDN on port 636, and again on port 3269; a successful connection shows RootDSE information.
    Configure CUCM for Secure LDAP (LDAPS) · section: Verify and Install LDAPS Certificates, Step 1 · Checked 2026-09-30
  39. 39
    Unified CM supports LDAPS (LDAP with SSL) but does not support LDAP with StartTLS.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: LDAP Synchronization Overview · Checked 2026-09-30
  40. 40
    After the LDAPS certificates are installed, Cisco Tomcat is restarted on each node with the CLI command 'utils service restart Cisco Tomcat', and the Cisco CTIManager service is restarted on each node where it is used.
    Configure CUCM for Secure LDAP (LDAPS) · section: Verify and Install LDAPS Certificates, Steps 3-4 · Checked 2026-09-30
  41. 41
    Cisco's secure LDAP technote configures the LDAP Directory for Active Directory LDAPS with the LDAPS server's FQDN or IP address, port 636, and Use TLS checked, followed by Perform Full Sync Now.
    Configure CUCM for Secure LDAP (LDAPS) · section: Configure Secure LDAP Directory, Steps 1-2 · Checked 2026-09-30
  42. 42
    When LDAP synchronization is enabled the local Unified CM database is still used, and additional local end-user accounts can be created.
    Preferred Architecture for Cisco Collaboration 12.x Enterprise On-Premises Deployments, CVD - Call Control · section: User Provisioning with LDAP Synchronization · Checked 2026-09-30
  43. 43
    Checking 'Apply mask to synced telephone numbers to create a new line for inserted users' and entering a mask creates a primary extension from the imported telephone number; Cisco's example is that mask 11XX yields extension 1145 from telephone number 8889945.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 10 · Checked 2026-09-30
  44. 44
    If neither the telephone-number mask nor the DN pool option is enabled on the LDAP directory sync, the sync should import end users without creating primary extensions, since Cisco describes automatic extension creation only for syncs that carry those settings.inferred
    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users · section: Import an End User from LDAP · Checked 2026-09-30
  45. 45
    Unified CM does not support mutual TLS for LDAP connections with Active Directory; if the LDAP server requests a client certificate during the TLS handshake, the connection attempt might fail.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · section: Supported LDAP Directories, Note · Checked 2026-09-30
  46. 46
    After the initial LDAP synchronization has occurred, new users can still be synchronized but new configurations, such as a feature group template, cannot be added to that LDAP directory sync.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Enable LDAP Directory Synchronization, Note; and section: LDAP Synchronization Overview · Checked 2026-09-30
  47. 47
    On Unified CM Release 15SU2, the LDAP directory and LDAP authentication manager passwords must consist only of ASCII characters and be at most 32 characters long.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Note after Step 3; section: Configure LDAP Authentication, Note after Step 4 · Checked 2026-09-30
  48. 48
    Because Cisco scopes the ASCII-only, 32-character LDAP manager password limit to Release 15SU2, the limit probably does not apply on 15SU3 and later, but this was not confirmed from a quoted sentence or a release note.inferred
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Note after Step 3 · Checked 2026-09-30
  49. 49
    An end user's password cannot be changed in Unified CM when LDAP authentication is enabled.
    Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users · section: Change the End User Password · Checked 2026-09-30
  50. 50
    Cisco's Release 15 port usage table lists TCP destination ports 389, 636, 3268 and 3269 from Unified CM to the external directory for LDAP queries, with return traffic to ephemeral ports.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage · Table: Ports Between Cisco Unified Communications Manager and LDAP Directory · Checked 2026-09-30
  51. 51
    Before importing users from LDAP, Cisco lists three prerequisite tasks: configure user access, configure default credentials, and set up a feature group template with user profiles, service profiles, and universal line and device templates.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: LDAP Synchronization Prerequisites · Checked 2026-09-30
  52. 52
    The LDAP Directory Synchronization Schedule fields in the LDAP Directory window define the schedule Unified CM uses to synchronize data with the external LDAP directory.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 4 · Checked 2026-09-30
  53. 53
    In the LDAP Server Information section of the LDAP Directory window the administrator enters the hostname or IP address of the LDAP server and checks Use TLS to create a secure connection.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Steps 13-14 · Checked 2026-09-30
  54. 54
    Cisco's Release 15 IM and Presence guide describes the LDAP Server Type list as offering Microsoft Active Directory, and Generic Directory Server for any other supported LDAP server type.
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · chapter: Configure LDAP Directory; sentence beginning 'Choose an LDAP server type from this list' · Checked 2026-09-30
  55. 55
    The Release 15x compatibility matrix lists as supported LDAP directories: Microsoft Active Directory on Windows Server 2016, 2019 and 2022, Microsoft Lightweight Directory Services 2019 and 2022, Oracle Unified Directory 12cPS4, OpenLDAP LTS Release 2.5.16, and other LDAPv3 compliant directories.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · section: Supported LDAP Directories · Checked 2026-09-30
  56. 56
    The Cisco DirSync service parameters default to a maximum of 20 agreements (LDAP directories that can be configured) and a maximum of 3 hosts (LDAP hostnames that can be configured for failover).
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · section: LDAP Directory Service Parameters · Checked 2026-09-30
  57. 57
    The LDAP agreement service parameters are set at System > Service Parameters in Cisco Unified CM Administration by choosing the publisher node as the server and Cisco DirSync as the service.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Customize LDAP Agreement Service Parameters · Checked 2026-09-30
  58. 58
    The Cisco DirSync timer defaults are: Retry Delay On Host Failure 5 seconds, Retry Delay On HostList Failure 10 minutes, LDAP Connection Timeout 5 seconds, and Delayed Sync Start time 5 minutes after the Cisco DirSync service starts.
    Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory · section: LDAP Directory Service Parameters · Checked 2026-09-30
  59. 59
    During LDAP synchronization, Unified CM imports a list of users and their associated user data from an external LDAP directory into the Unified CM database, and can repeat the import on a schedule to keep the data current.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: LDAP Synchronization Overview · Checked 2026-09-30
  60. 60
    Cisco's LDAP synchronization task flow has seven tasks in order: activate the Cisco DirSync service, enable LDAP directory synchronization, create an LDAP filter (optional), configure LDAP directory synchronization, configure enterprise directory user search (optional), configure LDAP authentication (optional), and customize LDAP agreement service parameters (optional).
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: LDAP Synchronization Configuration Task Flow · Checked 2026-09-30
  61. 61
    A universal device template is created at User Management > User/Phone Add > Universal Device Template, where a device pool, device security profile, SIP profile and phone button template are selected.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Provisioning Profiles · section: Configure a Universal Device Template · Checked 2026-09-30
  62. 62
    A universal line template is created at User Management > User/Phone Add > Universal Line Template and holds the common settings applied to newly provisioned extensions.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Provisioning Profiles · section: Configure a Universal Line Template · Checked 2026-09-30
  63. 63
    A user profile is created at User Management > User Settings > User Profile and assigns the universal device templates and the universal line template used for a user's newly provisioned phones and lines; it also holds the self-provisioning settings, with a limit of at most 20 phones per user.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Provisioning Profiles · section: Configure a User Profile · Checked 2026-09-30
  64. 64
    In the LDAP Directory window the synchronize setting is either Users Only or Users and Groups, and an LDAP filter can be selected to limit the import to a subset of users.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Step 3 sub-steps 5-6 · Checked 2026-09-30
  65. 65
    LDAP login is tested by signing in to the Self Care page at https://<publisher address>/ccmuser with the user's LDAP credentials.
    Configure CUCM for Secure LDAP (LDAPS) · section: Configure Secure LDAP Directory, Step 4 · Checked 2026-09-30
  66. 66
    A completed sync is verified by checking that the end users are present at User Management > End User in Cisco Unified CM Administration.
    Configure CUCM for Secure LDAP (LDAPS) · section: Configure Secure LDAP Directory, Step 3 · Checked 2026-09-30
  67. 67
    The Write back to LDAP option writes the primary DN chosen in Unified CM back to the LDAP server; the LDAP attributes available for write back are telephoneNumber, ipPhone and mobile.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · section: Configure LDAP Directory Synchronization, Note after Step 12 · Checked 2026-09-30
  68. 68
    LDAP directory synchronization is a mandatory prerequisite for enabling SAML SSO on Unified CM, and the SSO test must be run with an LDAP-synchronized user.
    SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration · Prerequisites, Directory setup; Run SSO test step · Checked 2026-09-30

Documents

tier 2 current vendor documentation

Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users

Cisco Systems · 2026-08-31 · accessed 2026-09-30

tier 2 current vendor documentation

Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x

Cisco Systems · 2026-07-16 · accessed 2026-09-24

tier 2 current vendor documentation

Configuration and Administration of the IM and Presence Service, Release 15 and SUs - Configure LDAP Directory

Cisco Systems · 2026-01-07 · accessed 2026-09-25

tier 2 current vendor documentation

Configure CUCM for Secure LDAP (LDAPS)

Cisco Systems · 2026-06-05 · accessed 2026-09-25

tier 2 current vendor documentation

Preferred Architecture for Cisco Collaboration 12.x Enterprise On-Premises Deployments, CVD - Call Control

Cisco Systems · 2019-02-19 · accessed 2026-09-25

tier 2 current vendor documentation

SAML SSO Deployment Guide for Cisco Unified Communications Applications, Release 15 and SUs - SAML SSO Configuration

Cisco · 2025-05-26 · accessed 2026-09-25

tier 2 current vendor documentation

System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Cisco Unified Communications Manager TCP and UDP Port Usage

Cisco Systems · 2026-09-22 · accessed 2026-09-24

tier 2 current vendor documentation

System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization

Cisco Systems · 2026-09-22 · accessed 2026-09-25

tier 2 current vendor documentation

System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure Provisioning Profiles

Cisco Systems · 2026-09-22 · accessed 2026-09-30

Cite this page

APA

WarmTransfer. (2026, September 30). Setting up LDAP directory sync and authentication in Unified CM. WarmTransfer. https://warmtransfer.net/guides/cucm-ldap-sync-setup

BibTeX

@misc{warmtransfer-cucm-ldap-sync-setup,
  title  = {Setting up LDAP directory sync and authentication in Unified CM},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/guides/cucm-ldap-sync-setup},
  note   = {Verified 2026-09-30}
}