WarmTransfer
cisco onprem uc · published

Unified CM LDAP directory sync and authentication

Verified 2026-09-25 · 58 sources · tier 1–2

Also known as Cisco DirSync, LDAP synchronization.

In Unified CM 15, LDAP synchronization imports a list of users and associated user data from an external LDAP directory into the Unified CM database 50. Unified CM 15 can also be configured to authenticate end user passwords against the LDAP directory instead of the Unified CM database 4.

Directory synchronization

Unified CM 15 can synchronize with multiple LDAP directories at scheduled intervals 31. To synchronize from LDAP, the Cisco DirSync service is activated in Cisco Unified Serviceability under Tools > Service Activation on the publisher node, under Directory Services 10. Directory synchronization is enabled in Cisco Unified CM Administration at System > LDAP > LDAP System by checking Enable Synchronizing from LDAP Server 11. The LDAP System Configuration window provides an LDAP Server Type drop-down for the directory type in use and an LDAP Attribute for User ID drop-down for the directory attribute mapping to the Unified CM user ID 41. Once the initial LDAP synchronization has occurred, edits cannot be made to that LDAP synchronization 32.

Prior to synchronization, several prerequisites apply:

  • Users' email ID fields on the Active Directory server must be unique entries or left blank 37.
  • A Feature Group Template must be set up beforehand 38.
  • The default credentials of the credential policy applied to newly provisioned users should be configured 36.

An optional LDAP filter, configured at System > LDAP > LDAP Filter, limits synchronization to the subset of directory users matching the filter 22. The LDAP Directory configuration includes LDAP Directory Synchronization Schedule fields defining when Unified CM synchronizes with the external directory 51. Once configured, an administrator can click Perform Full Sync Now to complete a sync or wait for the scheduled sync 34.

Within the LDAP Directory configuration, synced users can be added to access control groups and assigned a feature group template 1. A primary extension can be assigned to synced users by checking Apply mask to synced telephone numbers to create a new line for inserted users 28. When deploying URI dialing, the configuration should assign the LDAP attribute used for the user's primary directory URI 9. Users deleted in the LDAP directory are automatically removed from Unified CM after 24 hours 8.

Corporate directory searches can be offloaded: enabling user search at System > LDAP > LDAP Search via Enable user search to Enterprise Directory Server configures the User Data Service (UDS) to proxy user searches to the corporate directory instead of the Unified CM database 15.

Service parameters

LDAP synchronization behavior is governed by agreement service parameters 46​47​48​49:

  • Maximum Number of Agreements defaults to 20 46.
  • Maximum Number of Hosts defaults to 3 47.
  • Retry Delay On Host Failure defaults to 5 seconds 48.
  • Retry Delay On HotList failure defaults to 10 minutes 48.
  • LDAP Connection Timeouts defaults to 5 seconds 49.
  • Delayed Sync Start time defaults to 5 minutes 49.

LDAP authentication and security

Unified CM LDAP authentication applies to end user passwords only, not to end user PINs or application user passwords 5. Authentication is configured by checking Use LDAP Authentication for End Users and specifying the LDAP Manager Distinguished Name, the LDAP User Search Base, and the LDAP server hostname or IP address, with an optional Use TLS check box 3.

Unified CM supports LDAPS (LDAP with SSL) but does not support LDAP with StartTLS 25. StartTLS establishes TLS within an existing LDAP session as an extended operation defined in RFC 4511 section 4.14, whereas LDAPS initiates TLS at connection time 40. Transmitting passwords in the clear poses a significant security risk per RFC 4513 39.

For LDAPS configurations, tech note 215437 specifies installing the root and intermediate certificates of the LDAPS server certificate as tomcat-trust on each CUCM and IM and Presence publisher node, and as CallManager-trust on the CUCM publisher 23. Jabber client machines also require the LDAPS certificates installed as tomcat-trust on CUCM to be present in the client machine's certificate trust store 21. Where Jabber clients are present, Cisco recommends port 3269 for LDAPS authentication because Jabber login can time out if a secure connection to the global catalog server is not specified 26. Tech note 215437 states that no specific troubleshooting information is currently available for the described LDAPS configuration 52.

Since CUCM 10.5(2)SU2 and 9.1(2)SU3, the FQDN configured in LDAP Server Information is validated by default against the LDAP server certificate 17. Defect CSCun63825 introduced a failure where secure LDAP configured with IP addresses fails after upgrading to CUCM 10.5(2)SU2 or 9.1(2)SU3, producing "URL contains IP Address" in DirSync logs 19. The recommended fix is replacing IP addresses with the LDAP server FQDN in the configuration; running utils ldap config ipaddr stops enforcing the check when an IP address is used, and utils ldap config status displays the current mode 17​18.

Unified CM does not support mutual TLS (mTLS) for LDAP connections with Active Directory 33.

Supported directories and directory server behavior

The Unified CM 15x compatibility matrix lists the following supported LDAP directories:

  • Microsoft Active Directory on Windows Server 2016, 2019, and 2022 43.
  • Microsoft Lightweight Directory Services 2019 and 2022 44.
  • Oracle Unified Directory 12cPS4 45.
  • OpenLDAP Long Term Support release 2.5.16 45.
  • Other LDAPv3-compliant directories 45.

Unified CM uses standard LDAPv3 to access user data and requires the supportedcontrol attribute configured on LDAPv3-compliant directory servers used for sync 27. Enterprise Groups in Unified CM 15 are supported only with Microsoft Active Directory on Windows 12.

An Active Directory Domain Services (AD DS) domain controller accepts LDAP on port 389 and LDAPS on port 636; a global catalog server accepts LDAP on 3268 and LDAPS on 3269 2. Active Directory Lightweight Directory Services (AD LDS) ports are set when the instance is created 2.

New Active Directory deployments on Windows Server 2025 and later require LDAP signing by default, whereas Windows Server 2019 and earlier leave signing optional by default 57. Upgrading domain controllers from earlier Windows Server versions to Windows Server 2025 preserves existing LDAP signing and channel binding settings 58. A domain controller enforcing LDAP signing rejects simple binds over non-encrypted connections and rejects SASL binds that do not request signing 42. Directory Service event 2887 on a domain controller reports when clients make unsigned simple binds or SASL binds without SSL/TLS, and Microsoft recommends moving these clients to LDAPS or signed LDAP 16.

Unity Connection integration

When Cisco Unity Connection and Unified CM both require LDAP integration, each server must be integrated with the LDAP directory separately 6. In Cisco Unity Connection, voicemail passwords used from the telephone user interface are authenticated against the Unity Connection database even when LDAP authentication is enabled for web applications 7.

See also

Applicability

Applies to: Cisco Unified Communications Manager, Cisco Jabber with Cisco Unified Communications Manager, Cisco Unity Connection, IETF LDAP, and Microsoft Active Directory Domain Services. Deployments: on-premises and standard. Sources checked 2026-09-25. Certificate hostname validation enforcement applies since CUCM 10.5(2)SU2 and 9.1(2)SU3 17.

What remains uncertain

Whether Microsoft Entra ID or Webex Cloud-Connected UC directory service can serve directly as a Unified CM user source is not covered by the sources below. Support status for Microsoft Windows Server 2025 Active Directory with Unified CM 15 is not covered by the sources below. Whether Unified CM supports LDAP channel binding tokens and signed binds is not covered by the sources below. Unified CM LDAP user capacity resolution is not covered by the sources below. Official DirSync trace and log file locations across RTMT and CLI file tail commands are not covered by the sources below. The interplay between SSO SAML and LDAP authentication for end users is not covered by the sources below. The complete list of enumerated values for the LDAP Server Type and LDAP Attribute for User ID drop-downs is not covered by the sources below. Procedures for converting local users to LDAP-synchronized users and rules governing their coexistence are not covered by the sources below.

See also

Related to

  • Cisco Jabber service discovery and sign-in — Jabber directory search via UDS proxying to the enterprise LDAP directory and Jabber trust of LDAPS certificates overlap with this topic; relationship proposed by this run and not previously recorded

Referenced by

  • Cisco Jabber service discovery and sign-in — Inbound relationship already recorded. Jabber directory search through UDS proxying to LDAP; and Jabber trust of LDAPS and Tomcat certificates; overlap with this topic.

Sources

  1. 1
    An LDAP Directory configuration can add synced users to access control groups and apply a feature group template to them.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization · Checked 2026-09-25
  2. 2
    An AD DS domain controller accepts LDAP on port 389 and LDAPS on port 636, and a global catalog server also accepts LDAP on 3268 and LDAPS on 3269; AD LDS ports are set when the instance is created.
    [MS-ADTS]: Ports · [MS-ADTS] Ports (whole section) · Checked 2026-09-25
  3. 3
    LDAP authentication is configured by checking Use LDAP Authentication for End Users and entering the LDAP Manager Distinguished Name, the LDAP User Search Base and the LDAP server hostname or IP address, with an optional Use TLS check box.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Authentication · Checked 2026-09-25
  4. 4
    Unified CM 15 can be configured to authenticate end user passwords against the LDAP directory instead of the Unified CM database.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Overview · Checked 2026-09-25
  5. 5
    Unified CM LDAP authentication applies to end user passwords only and not to end user PINs or application user passwords.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Authentication · Checked 2026-09-25
  6. 6
    When Unity Connection and Unified CM both need LDAP integration, each server must be integrated with the LDAP directory separately.
    System Administration Guide for Cisco Unity Connection Release 15 - LDAP · LDAP chapter > introduction · Checked 2026-09-25
  7. 7
    In Unity Connection, voicemail passwords used from the telephone user interface are authenticated against the Unity Connection database even when LDAP authentication is enabled for web applications.
    System Administration Guide for Cisco Unity Connection Release 15 - LDAP · LDAP chapter > LDAP authentication · Checked 2026-09-25
  8. 8
    Users deleted in the LDAP directory are automatically removed from Unified CM after 24 hours.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization (note) · Checked 2026-09-25
  9. 9
    When deploying URI dialing, the LDAP Directory configuration should assign the LDAP attribute used for the user's primary directory URI.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization · Checked 2026-09-25
  10. 10
    To synchronize from LDAP, the Cisco DirSync service is activated in Cisco Unified Serviceability under Tools > Service Activation on the publisher node, under Directory Services.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Activate the Cisco DirSync Service · Checked 2026-09-25
  11. 11
    LDAP directory synchronization is enabled from Cisco Unified CM Administration at System > LDAP > LDAP System by checking Enable Synchronizing from LDAP Server.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Enable LDAP Directory Synchronization · Checked 2026-09-25
  12. 12
    Enterprise Groups in Unified CM 15 are supported only with Microsoft Active Directory on Windows as the external LDAP directory.
    Feature Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Enterprise Groups · Enterprise Groups > overview / prerequisites · Checked 2026-09-25
  13. 13
    Unified CM 15 supports up to 15,000 user groups synced from Microsoft Active Directory for Enterprise Groups.
    Feature Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Enterprise Groups · Enterprise Groups > limits · Checked 2026-09-25
  14. 14
    Enterprise Groups require the LDAP Directory Synchronize field to be set to Users and Groups, with the Cisco DirSync service active and regular LDAP syncs scheduled.
    Feature Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Enterprise Groups · Enterprise Groups > prerequisites and configuration task flow · Checked 2026-09-25
  15. 15
    Enterprise directory user search is enabled at System > LDAP > LDAP Search with Enable user search to Enterprise Directory Server, after which User Data Service (UDS) proxies user searches to the corporate directory instead of the Unified CM database.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure Enterprise Directory User Search; LDAP Synchronization Overview · Checked 2026-09-25
  16. 16
    Directory Service event 2887 on a domain controller reports that clients made unsigned simple binds or SASL binds without SSL/TLS, and Microsoft recommends moving such clients to LDAPS or signed LDAP.
    LDAP signing for Active Directory Domain Services on Windows Server · Event monitoring > LDAP signing events table · Checked 2026-09-25
  17. 17
    Since CUCM 10.5(2)SU2 and 9.1(2)SU3, the FQDN configured in LDAP Server Information is checked by default against the LDAP server certificate, and utils ldap config ipaddr stops enforcing that check when an IP address is used.
    Configure CUCM for Secure LDAP (LDAPS) · Configure > note on FQDN and Common Name · Checked 2026-09-25
  18. 18
    The recommended fix for that failure is to replace IP addresses with the LDAP server FQDN in the LDAP configuration; utils ldap config ipaddr is the alternative, and utils ldap config status shows the current mode.
    Secure LDAP Problems After an Upgrade to CUCM 10.5(2)SU2 · Solution · Checked 2026-09-25
  19. 19
    After upgrading to CUCM 10.5(2)SU2 or 9.1(2)SU3, secure LDAP configured with IP addresses fails and DirSync logs show URL contains IP Address, a change introduced by defect CSCun63825.
    Secure LDAP Problems After an Upgrade to CUCM 10.5(2)SU2 · Problem; Cause · Checked 2026-09-25
  20. 20
    The LDAP Directory configuration has a Jabber Endpoint Provisioning section for auto-provisioning Jabber devices for synced users.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization (Jabber Endpoint Provisioning) · Checked 2026-09-25
  21. 21
    Jabber client machines also need the LDAPS certificates installed as tomcat-trust on CUCM to be present in the client machine's certificate trust store.
    Configure CUCM for Secure LDAP (LDAPS) · Configure > Jabber client note · Checked 2026-09-25
  22. 22
    An optional LDAP filter, created at System > LDAP > LDAP Filter, limits synchronization to the subset of directory users that match the filter.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Create an LDAP Filter · Checked 2026-09-25
  23. 23
    For LDAPS, tech note 215437 says to install the root and intermediate certificates of the LDAPS server certificate as tomcat-trust on each of the CUCM and IM and Presence publisher nodes and as CallManager-trust on the CUCM publisher.
    Configure CUCM for Secure LDAP (LDAPS) · Configure > certificate installation step · Checked 2026-09-25
  24. 24
    Tech note 215437 configures the LDAP Directory on port 636 with Use TLS checked and the LDAP Authentication on port 3269 with Use TLS checked.
    Configure CUCM for Secure LDAP (LDAPS) · Configure > LDAP Directory; LDAP Authentication · Checked 2026-09-25
  25. 25
    Unified CM supports LDAPS (LDAP with SSL) but does not support LDAP with StartTLS.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Overview (note) · Checked 2026-09-25
  26. 26
    Where Jabber clients are present, Cisco recommends port 3269 for LDAPS authentication because Jabber login can time out if a secure connection to the global catalog server is not specified.
    Configure CUCM for Secure LDAP (LDAPS) · Configure > LDAP Authentication · Checked 2026-09-25
  27. 27
    Unified CM uses standard LDAPv3 to access user data and requires the supportedcontrol attribute to be configured on LDAPv3-compliant directory servers used for sync.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · Supported LDAP Directories (note) · Checked 2026-09-25
  28. 28
    A primary extension can be assigned to synced users by checking Apply mask to synced telephone numbers to create a new line for inserted users.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization · Checked 2026-09-25
  29. 29
    Cisco's 2017 multi-forest tech note says CUCM cannot synchronize directly from multiple Active Directory forests and uses AD LDS (formerly ADAM) to aggregate users from each forest, with CUCM syncing from the AD LDS instance.
    How to Configure Unified Communications Manager Directory Integration in a Multi-Forest Environment · Introduction; Solution overview · Checked 2026-09-25
  30. 30
    In the AD LDS multi-forest design, user IDs (sAMAccountName) must be unique across all forests, and AD LDS proxy objects redirect binds to the originating domain controllers without storing passwords.
    How to Configure Unified Communications Manager Directory Integration in a Multi-Forest Environment · Requirements; bind redirection section · Checked 2026-09-25
  31. 31
    Unified CM 15 can be configured to synchronize with multiple LDAP directories at scheduled intervals.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Overview · Checked 2026-09-25
  32. 32
    Once the initial LDAP synchronization has occurred, edits cannot be made to that LDAP synchronization.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Enable LDAP Directory Synchronization (note) · Checked 2026-09-25
  33. 33
    Unified CM does not support mutual TLS (mTLS) for LDAP connections with Active Directory.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · Supported LDAP Directories (note) · Checked 2026-09-25
  34. 34
    After an LDAP directory is configured, an administrator can click Perform Full Sync Now to complete a sync or wait for the scheduled sync.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization · Checked 2026-09-25
  35. 35
    A Unified CM LDAP directory or authentication configuration that uses plain LDAP on port 389 without Use TLS is likely to have its simple binds rejected by a domain controller that enforces LDAP signing, and because Unified CM does not support StartTLS, LDAPS on 636 or 3269 is the supported way to encrypt those binds.inferred
    LDAP signing for Active Directory Domain Services on Windows Server · How LDAP signing works; combined with cisco-cucm-sysconfig-15-ldap-sync LDAP Synchronization Overview · Checked 2026-09-25
  36. 36
    Before LDAP sync, the default credentials of the credential policy applied to newly provisioned users should be configured.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Prerequisites · Checked 2026-09-25
  37. 37
    Before syncing, users' email ID fields on the Active Directory server must be unique entries or left blank.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Prerequisites · Checked 2026-09-25
  38. 38
    Syncing users from an LDAP directory requires a Feature Group Template to be set up beforehand.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Prerequisites · Checked 2026-09-25
  39. 39
    RFC 4513 warns that transmitting passwords in the clear poses a significant security risk.
    Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms · Section 6.3.3 · Checked 2026-09-25
  40. 40
    StartTLS establishes TLS within an existing LDAP session and is defined as an extended operation in RFC 4511 section 4.14, which differs from LDAPS where TLS starts at connection time.
    Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms · Section 3 (StartTLS Operation) · Checked 2026-09-25
  41. 41
    The LDAP System Configuration window has an LDAP Server Type drop-down for the directory type in use and an LDAP Attribute for User ID drop-down for the directory attribute that maps to the Unified CM user ID.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Enable LDAP Directory Synchronization · Checked 2026-09-25
  42. 42
    A domain controller that enforces LDAP signing rejects SASL binds that do not request signing and rejects simple binds over non-encrypted connections.
    LDAP signing for Active Directory Domain Services on Windows Server · How LDAP signing works · Checked 2026-09-25
  43. 43
    The Unified CM 15x compatibility matrix lists Microsoft Active Directory on Windows Server 2016, 2019 and 2022 as supported LDAP directories.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · Supported LDAP Directories · Checked 2026-09-25
  44. 44
    The Unified CM 15x compatibility matrix lists Microsoft Lightweight Directory Services 2019 and 2022 as supported LDAP directories.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · Supported LDAP Directories · Checked 2026-09-25
  45. 45
    The Unified CM 15x compatibility matrix lists Oracle Unified Directory 12cPS4 and OpenLDAP Long Term Support release 2.5.16 as supported LDAP directories, plus other LDAPv3-compliant directories.
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · Supported LDAP Directories · Checked 2026-09-25
  46. 46
    The LDAP agreement service parameter Maximum Number of Agreements defaults to 20.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Customize LDAP Agreement Service Parameters · Checked 2026-09-25
  47. 47
    The LDAP agreement service parameter Maximum Number of Hosts defaults to 3.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Customize LDAP Agreement Service Parameters · Checked 2026-09-25
  48. 48
    Retry Delay On Host Failure defaults to 5 seconds and Retry Delay On HotList failure defaults to 10 minutes.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Customize LDAP Agreement Service Parameters · Checked 2026-09-25
  49. 49
    LDAP Connection Timeouts defaults to 5 seconds and Delayed Sync Start time defaults to 5 minutes.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Customize LDAP Agreement Service Parameters · Checked 2026-09-25
  50. 50
    In Unified CM 15, LDAP synchronization imports a list of users and associated user data from an external LDAP directory into the Unified CM database.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > LDAP Synchronization Overview · Checked 2026-09-25
  51. 51
    The LDAP Directory configuration contains LDAP Directory Synchronization Schedule fields that define when Unified CM synchronizes with the external directory.
    System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization · Configure LDAP Synchronization > Configure LDAP Directory Synchronization · Checked 2026-09-25
  52. 52
    Tech note 215437 states that no specific troubleshooting information is currently available for the LDAPS configuration it describes.
    Configure CUCM for Secure LDAP (LDAPS) · Troubleshoot · Checked 2026-09-25
  53. 53
    After uploading LDAPS trust certificates, tech note 215437 restarts the Cisco Tomcat service on each CUCM and IM and Presence node with utils service restart Cisco Tomcat.
    Configure CUCM for Secure LDAP (LDAPS) · Configure > restart services step · Checked 2026-09-25
  54. 54
    The Unity Connection 15 LDAP chapter states that the practical limit of users that can be imported into the Cisco Unified CM database is 120,000.disputed
    System Administration Guide for Cisco Unity Connection Release 15 - LDAP · LDAP chapter > directory configuration limits · Checked 2026-09-25
  55. 55
    Cisco's Release 15 Enterprise Groups chapter gives 160,000 as the maximum number of user accounts in the Unified CM database, and the 2017 multi-forest note gives 160,000 synchronized accounts for CUCM 10.0(1) and later.disputed
    Feature Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Enterprise Groups · Enterprise Groups > limits (maximum user accounts) · Checked 2026-09-25
  56. 56
    Active Directory on Windows Server 2025 is not named in the Unified CM 15x supported LDAP directory list as of the 2026-07-16 matrix revision, so its support status rests only on the generic LDAPv3-compliant category.inferred
    Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x · Supported LDAP Directories (absence of a Windows Server 2025 entry) · Checked 2026-09-25
  57. 57
    New Active Directory deployments on Windows Server 2025 and later require LDAP signing by default, while Windows Server 2019 and earlier leave signing optional by default.
    LDAP signing for Active Directory Domain Services on Windows Server · Default security behavior > Windows Server 2025 and later; Windows Server 2019 and earlier · Checked 2026-09-25
  58. 58
    Upgrading domain controllers from earlier Windows Server versions to Windows Server 2025 preserves the existing LDAP signing and channel binding settings.
    LDAP signing for Active Directory Domain Services on Windows Server · Default security behavior > Upgrade considerations · Checked 2026-09-25

Documents

tier 1 standards and regulators

Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms

IETF / RFC Editor · 2006-06-01 · accessed 2026-09-25

tier 2 current vendor documentation

[MS-ADTS]: Ports

Microsoft · 2025-04-08 · accessed 2026-09-25

tier 2 current vendor documentation

Compatibility Matrix for Cisco Unified Communications Manager and the IM and Presence Service, Release 15x

Cisco Systems · 2026-07-16 · accessed 2026-09-24

tier 2 current vendor documentation

Configure CUCM for Secure LDAP (LDAPS)

Cisco Systems · 2026-06-05 · accessed 2026-09-25

tier 2 current vendor documentation

Feature Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Enterprise Groups

Cisco Systems · 2026-09-16 · accessed 2026-09-25

tier 2 current vendor documentation

How to Configure Unified Communications Manager Directory Integration in a Multi-Forest Environment

Cisco Systems · 2017-04-18 · accessed 2026-09-25

tier 2 current vendor documentation

LDAP signing for Active Directory Domain Services on Windows Server

Microsoft · 2026-01-15 · accessed 2026-09-25

tier 2 current vendor documentation

Secure LDAP Problems After an Upgrade to CUCM 10.5(2)SU2

Cisco Systems · 2016-04-18 · accessed 2026-09-25

tier 2 current vendor documentation

System Administration Guide for Cisco Unity Connection Release 15 - LDAP

Cisco Systems · 2023-06-27 · accessed 2026-09-25

tier 2 current vendor documentation

System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization

Cisco Systems · 2026-09-22 · accessed 2026-09-25

Cite this page

APA

WarmTransfer. (2026, September 25). Unified CM LDAP directory sync and authentication. WarmTransfer. https://warmtransfer.net/knowledge/cucm-ldap-integration

BibTeX

@misc{warmtransfer-cucm-ldap-integration,
  title  = {Unified CM LDAP directory sync and authentication},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cucm-ldap-integration},
  note   = {Verified 2026-09-25}
}