# Troubleshooting LDAP directory sync failures in Unified CM Canonical: https://warmtransfer.net/knowledge/cucm-ldap-sync-troubleshooting Last verified: 2026-10-02 The Cisco DirSync service migrates user data from an integrated corporate directory such as Microsoft Active Directory into the Unified CM database[^16]. With LDAP synchronization, user data from the LDAP store is copied into the corresponding Unified CM database fields on a schedule, and the corporate directory remains the central repository[^41]. ## How synchronization is put together LDAP synchronization can run only after the Cisco DirSync service is activated on the publisher node, in Cisco Unified Serviceability under Tools > Service Activation > Directory Services[^15]. Synchronization is enabled under System > LDAP > LDAP System by checking Enable Synchronizing from LDAP Server and choosing the LDAP Server Type and the LDAP Attribute for User ID[^17]. The Unified CM User ID field is populated from whichever corporate directory attribute the administrator selects in the LDAP Attribute for User ID drop-down list[^53]. Each LDAP Directory agreement synchronizes either Users Only or Users and Groups[^54]. The default maximum number of LDAP directories (sync agreements) is 20, and this is adjustable through the Cisco DirSync service parameters[^37]. Those agreement service parameters are edited under System > Service Parameters by selecting the publisher and the Cisco DirSync service[^49]. Clicking Perform Full Sync on an LDAP Directory imports any new end users from the directory immediately instead of waiting for the scheduled sync[^23]. Users deleted in LDAP are automatically removed from Unified Communications Manager after 24 hours[^11]. The Cisco DirSync service does not synchronize passwords from the corporate directory[^14]. Instead, passwords of users imported from LDAP are authenticated against the corporate directory with a simple bind, while locally configured users authenticate against the Unified CM database[^42]. LDAP authentication applies only to end-user passwords, and application users and PINs remain managed in the local database[^3]. Unified CM uses a single LDAP authentication configuration for the whole cluster[^43]. ## Data prerequisites Users to be synchronized must have email ID fields in Active Directory that are either unique or left blank[^51]. For URI dialing, the LDAP Directory agreement must map an LDAP attribute to the user's primary directory URI[^12]. Enterprise Directory User Search (System > LDAP > LDAP Search) lets phones and clients search the LDAP directory, and the LDAP servers must be reachable from the subscriber nodes[^18]. ## LDAPS and certificate failures Unified Communications Manager supports LDAPS (LDAP over SSL) for directory synchronization but does not support LDAP with StartTLS[^31]. In the LDAP Directory configuration, you select a secure connection to the LDAP server by checking Use TLS next to the server hostname or IP address[^52]. Cisco's LDAPS configuration example uses port 636 with Use TLS checked for the LDAP Directory (synchronization) agreement[^33]. The same example uses port 3269 with Use TLS for LDAP Authentication[^32]. Cisco's port guidance for LDAP is as follows[^24]: | Server type | Without SSL | With SSL | |---|---|---| | Non-Global Catalog | 389 | 636 | | Global Catalog | 3268 | 3269 | For LDAPS, the LDAP server certificate must be uploaded to Unified Communications Manager as a Tomcat-Trust certificate[^27]. Cisco's LDAPS TechNote has the directory's root and intermediate certificates uploaded as tomcat-trust on each Unified CM node and also on the IM and Presence servers in the cluster[^28]. The same TechNote also says to install the root and intermediate certificates as CallManager-trust on the Unified CM publisher, a step it does not illustrate[^25]. Cisco says LDAP over SSL problems usually come from invalid, wrong or incomplete certificate chains on Unified CM, and it recommends uploading the root and intermediate certificates but not the leaf[^26]. When you check an LDAPS chain, Cisco advises confirming that the root certificate's Issuer and Subject match and that no certificate in the chain has expired[^34]. From releases 10.5(2)SU2 and 9.1(2)SU3, Unified CM by default checks the FQDN configured in LDAP Server Information against the Common Name of the LDAP server certificate[^29]. If the LDAP server is configured by IP address rather than FQDN, run the CLI command `utils ldap config ipaddr` so that the FQDN-to-certificate check is not enforced[^30]. After you upload LDAPS trust certificates, restart Cisco Tomcat from each node's CLI with `utils service restart Cisco Tomcat`[^45]. After Cisco Tomcat is restarted, users sometimes fail to synchronize over the secure port, and Cisco states that the Cisco DirSync service must then be restarted for synchronization to succeed[^44]. Cisco documents a case where CTI/JTAPI client authentication fails while Unified CM user login works, because OpenLDAP cannot verify the LDAP server certificate[^9]. In Cisco's 12.5(1) troubleshooting guide, the documented fix is to use DNS names, or to set `TLS_REQCERT never` in `/etc/openldap/ldap.conf` when IP addresses are used[^9]. Cisco verifies an LDAPS setup in 2 ways: by checking that end users appear under User Management > End User, and by confirming that a synchronized user can log in to the ccmuser page[^35]. ## Authentication and login symptoms Cisco lists a misconfigured LDAP port in the LDAP Authentication window as a possible cause of end-user login timeouts[^5]. Compare the configured port against Cisco's port guidance above[^24]. ## LDAP filter errors Custom LDAP filters are optional and are created under System > LDAP > LDAP Filter to restrict synchronization to a subset of users[^21]. Any LDAP filter configured in Unified CM must comply with the LDAP search filter standard in RFC 4515[^22]. A Unified CM LDAP filter is limited to 1024 UTF-8 characters and must be enclosed in parentheses[^19]. RFC 4515 filters combine conditions with `&` (AND), `|` (OR) and `!` (NOT), and each filter is enclosed in parentheses[^47]. In an LDAP string filter, the characters asterisk, left parenthesis, right parenthesis, backslash and NUL must be escaped as `\2a`, `\28`, `\29`, `\5c` and `\00`[^46]. Active Directory implements the matching rule OID 1.2.840.113556.1.4.803 (LDAP_MATCHING_RULE_BIT_AND) for bitwise AND comparisons in LDAP filters, and the comparison value must be decimal[^2]. In Active Directory, the userAccountControl ACCOUNTDISABLE flag is 0x0002 (decimal 2), and a disabled normal user account typically has userAccountControl 514[^1]. We infer that a Unified CM custom LDAP filter can exclude disabled Active Directory accounts by negating a bitwise-AND test on userAccountControl, for example `(&(objectclass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2)))`[^20]. ## Correcting an agreement after the initial sync An LDAP synchronization agreement cannot be edited once its initial synchronization has occurred[^39]. To add configuration such as a feature group template after an LDAP directory's initial sync, Cisco directs administrators to use Bulk Administration or to configure a new LDAP sync[^6]. WarmTransfer's reading of the sources is that fixing a wrong filter or attribute mapping in practice means creating a new agreement, or using Bulk Administration, rather than editing the existing one[^7]. Field reports suggest that after a user ID is changed in Active Directory, a full sync may not update the Unified CM user ID, which breaks Extension Mobility login[^50]. In the field, restarting Cisco DirSync and then running a full sync again resolved it[^50]. ## Collecting DirSync logs You can collect the Cisco DirSync log from the CLI with `file get activelog cm/trace/dirsync/log4j/dirsync.log`[^13]. Collecting Unified CM logs with `file get activelog` requires an external SFTP server that is configured and reachable[^36]. ## See also - [Setting up LDAP directory sync and authentication in Unified CM](https://warmtransfer.net/knowledge/cucm-ldap-sync-setup) - [Unified CM LDAP directory sync and authentication](https://warmtransfer.net/knowledge/cucm-ldap-integration) - [Troubleshooting Extension Mobility login failures in Unified CM](https://warmtransfer.net/knowledge/cucm-extension-mobility-troubleshooting) - [Unified CM certificate renewal](https://warmtransfer.net/knowledge/cucm-certificate-renewal) - [Unified CM Bulk Administration Tool export formats](https://warmtransfer.net/knowledge/cucm-bulk-administration-tool) ## Applicability Applies to: Cisco Unified Communications Manager and Microsoft Active Directory. Deployments: on-premises. Sources checked 2026-10-02. The FQDN-to-Common-Name certificate check applies by default from releases 10.5(2)SU2 and 9.1(2)SU3[^29]. The LDAPS trust-certificate guidance covers IM and Presence servers in the cluster as well as Unified CM nodes[^28]. The filter examples for disabled accounts depend on Active Directory's userAccountControl flags and bitwise matching rule[^1][^2]. ## What remains uncertain Users deleted in LDAP are removed after 24 hours[^11]. The clock time of the daily purge of inactive LDAP-synchronized users, and whether that time is configurable, is not covered by the sources below. We infer that changing the LDAP Attribute for User ID after sync means creating a new agreement or using Bulk Administration[^7]. The full procedure for that change, and what happens to users from a deleted agreement, is not covered by the sources below. The meaning of the End User status values (Active Local, Active LDAP Synchronized, Inactive LDAP Synchronized) is not covered by the sources below. The DirSync log location is documented[^13]. A catalogue of DirSync log error strings, such as duplicate email, DiscoveryUserIdentity already exists, or certificate_unknown, is not covered by the sources below. The default maximum of 20 sync agreements is documented[^37]. Per-agreement and per-cluster user sync scale limits are not covered by the sources below. Directory integration for hosted dedicated deployments through a cloud identity service is not covered by the sources below. LDAP sync troubleshooting for other Cisco collaboration products that use their own directory sync implementation is not covered by the sources below. Whether a local user is silently converted to an LDAP-synchronized user when its user ID matches a directory account is not covered by the sources below. ## Sources [^1]: In Active Directory the userAccountControl ACCOUNTDISABLE flag is 0x0002 (decimal 2), and a disabled normal user account typically has userAccountControl 514. Source: [UserAccountControl property flags - Windows Server](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties), List of property flags (table and preceding paragraph). Checked 2026-10-02. [^2]: Active Directory implements the matching rule OID 1.2.840.113556.1.4.803 (LDAP_MATCHING_RULE_BIT_AND) for bitwise AND comparisons in LDAP filters, and the comparison value must be decimal. Source: [Search Filter Syntax - Win32 apps](https://learn.microsoft.com/en-us/windows/win32/adsi/search-filter-syntax), Operators, matching rule OID table. Checked 2026-10-02. [^3]: LDAP authentication in Unified CM applies only to end-user passwords; application users and PINs remain managed in the local database. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Identity Management](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_identity-management.html), Identity Management > LDAP Authentication. Checked 2026-10-02. [^4]: On Unified CM 15SU2, LDAP authentication passwords had to be ASCII-only and at most 32 characters; the system configuration guide says this restriction was lifted in 15SU3 and later. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Authentication, note. Checked 2026-10-02. [^5]: Cisco lists a misconfigured LDAP port in the LDAP Authentication window as a possible cause of end-user login timeouts. Source: [Troubleshooting Guide for Cisco Unified Communications Manager, Release 12.5(1) - Cisco Unified Communications Manager System Issues](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/12_5_1/cucm_b_troubleshooting-guide-1251/cucm_b_troubleshooting-guide-1251_chapter_011.html), LDAP Authentication Fails. Checked 2026-10-02. [^6]: To add configuration such as a feature group template after an LDAP directory's initial sync, Cisco directs administrators to use Bulk Administration or configure a new LDAP sync. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_011.html), Manage End Users, LDAP sync note. Checked 2026-10-02. [^7]: Because an LDAP agreement cannot be edited after its initial sync, fixing a wrong filter or attribute mapping in practice means creating a new agreement (or using Bulk Administration) rather than editing the existing one (inferred). Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), LDAP Synchronization Overview, note on edits after initial sync. Checked 2026-10-02. [^8]: The default LDAP connection timeout in the Cisco DirSync service parameters is 5 seconds. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Customize LDAP Agreement Service Parameters, LDAP Connection Timeout row. Checked 2026-10-02. [^9]: Cisco documents that CTI/JTAPI client authentication can fail while Unified CM user login works because OpenLDAP cannot verify the LDAP server certificate; the fix is to use DNS names or set TLS_REQCERT never in /etc/openldap/ldap.conf when IP addresses are used. Source: [Troubleshooting Guide for Cisco Unified Communications Manager, Release 12.5(1) - Cisco Unified Communications Manager System Issues](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/12_5_1/cucm_b_troubleshooting-guide-1251/cucm_b_troubleshooting-guide-1251_chapter_011.html), Open LDAP Cannot Verify the Certificate to Connect to the LDAP Server. Checked 2026-10-02. [^10]: When an LDAP-synchronized user is deleted, the associated mobility devices and profiles (for example Remote Destination Profile, Mobile Smart Client, CTI Remote Device and Cisco Dual Mode devices) are deleted automatically. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), LDAP Synchronization Overview, deleted users note (device list). Checked 2026-10-02. [^11]: Users deleted in LDAP are automatically removed from Unified Communications Manager after 24 hours. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), LDAP Synchronization Overview, deleted users note. Checked 2026-10-02. [^12]: For URI dialing, the LDAP Directory agreement must map an LDAP attribute to the user's primary directory URI. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Directory Synchronization, standard user fields step. Checked 2026-10-02. [^13]: The Cisco DirSync log can be collected from the CLI with file get activelog cm/trace/dirsync/log4j/dirsync.log. Source: [Collect CUCM Logs if RTMT Is Not Accessible or Available](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/211351-Collect-Communication-Manager-Logs-via-t.html), CLI log collection commands, DirSync entry. Checked 2026-10-02. [^14]: The Cisco DirSync service does not synchronize passwords from the corporate directory. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Services](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010111.html), Feature Services > Directory Services > Cisco DirSync. Checked 2026-10-02. [^15]: The Cisco DirSync service must be activated on the publisher node, in Cisco Unified Serviceability under Tools > Service Activation > Directory Services, before LDAP synchronization can run. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Activate the Cisco DirSync Service, steps 1-4. Checked 2026-10-02. [^16]: The Cisco DirSync service migrates user data from an integrated corporate directory such as Microsoft Active Directory into the Unified CM database. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Services](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_010111.html), Feature Services > Directory Services > Cisco DirSync. Checked 2026-10-02. [^17]: LDAP synchronization is enabled under System > LDAP > LDAP System by checking Enable Synchronizing from LDAP Server and choosing the LDAP Server Type and the LDAP Attribute for User ID. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Enable LDAP Directory Synchronization, steps 1-5. Checked 2026-10-02. [^18]: Enterprise Directory User Search (System > LDAP > LDAP Search) lets phones and clients search the LDAP directory, and the LDAP servers must be reachable from the subscriber nodes. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure Enterprise Directory User Search. Checked 2026-10-02. [^19]: A Unified CM LDAP filter is limited to 1024 UTF-8 characters and must be enclosed in parentheses. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Create an LDAP Filter, filter field description. Checked 2026-10-02. [^20]: A Unified CM custom LDAP filter can exclude disabled Active Directory accounts by negating a bitwise-AND test on userAccountControl, for example (&(objectclass=user)(!(userAccountControl:1.2.840.113556.1.4.803:=2))) (inferred). Source: [UserAccountControl property flags - Windows Server](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/useraccountcontrol-manipulate-account-properties), List of property flags (ACCOUNTDISABLE) combined with Search Filter Syntax matching rule table. Checked 2026-10-02. [^21]: Custom LDAP filters are optional and are created under System > LDAP > LDAP Filter to restrict synchronization to a subset of users. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Create an LDAP Filter. Checked 2026-10-02. [^22]: Any LDAP filter configured in Unified CM must comply with the LDAP search filter standard in RFC 4515. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Create an LDAP Filter. Checked 2026-10-02. [^23]: Clicking Perform Full Sync on an LDAP Directory imports any new end users from the directory immediately instead of waiting for the scheduled sync. Source: [Administration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Manage End Users](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/adminGd/cucm_b_administration-guide-15/cucm_b_test-adminguide_chapter_011.html), Manage End Users, import users from LDAP procedure. Checked 2026-10-02. [^24]: Cisco's port guidance for LDAP is 389 without SSL or 636 with SSL for a non-Global Catalog server, and 3268 without SSL or 3269 with SSL for a Global Catalog server. Source: [Troubleshooting Guide for Cisco Unified Communications Manager, Release 12.5(1) - Cisco Unified Communications Manager System Issues](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/12_5_1/cucm_b_troubleshooting-guide-1251/cucm_b_troubleshooting-guide-1251_chapter_011.html), LDAP Authentication Fails, Recommended Action. Checked 2026-10-02. [^25]: Cisco's LDAPS TechNote also says to install the root and intermediate certificates as CallManager-trust on the Unified CM publisher, a step it does not illustrate. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, certificate upload steps. Checked 2026-10-02. [^26]: Cisco says LDAP over SSL problems usually come from invalid, wrong or incomplete certificate chains on Unified CM, and recommends uploading the root and intermediate certificates but not the leaf. Source: [Troubleshooting Guide for Cisco Unified Communications Manager, Release 12.5(1) - Cisco Unified Communications Manager System Issues](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/12_5_1/cucm_b_troubleshooting-guide-1251/cucm_b_troubleshooting-guide-1251_chapter_011.html), Issues with LDAP Over SSL. Checked 2026-10-02. [^27]: For LDAPS, the LDAP server certificate must be uploaded to Unified Communications Manager as a Tomcat-Trust certificate. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Synchronization > LDAP Synchronization Overview (LDAPS note). Checked 2026-10-02. [^28]: For LDAPS, the directory's root and intermediate certificates are uploaded as tomcat-trust on each Unified CM node and also on IM and Presence servers in the cluster. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, certificate upload steps. Checked 2026-10-02. [^29]: From releases 10.5(2)SU2 and 9.1(2)SU3, Unified CM by default checks the FQDN configured in LDAP Server Information against the Common Name of the LDAP server certificate. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, LDAP Directory configuration note. Checked 2026-10-02. [^30]: When the LDAP server is configured by IP address rather than FQDN, the CLI command utils ldap config ipaddr is used so the FQDN-to-certificate check is not enforced. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, LDAP Directory configuration note. Checked 2026-10-02. [^31]: Unified Communications Manager supports LDAPS (LDAP over SSL) for directory synchronization but does not support LDAP with StartTLS. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Synchronization > LDAP Synchronization Overview. Checked 2026-10-02. [^32]: Cisco's LDAPS configuration example uses port 3269 with Use TLS for LDAP Authentication. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, LDAP Authentication. Checked 2026-10-02. [^33]: Cisco's LDAPS configuration example uses port 636 with Use TLS checked for the LDAP Directory (synchronization) agreement. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, LDAP Directory. Checked 2026-10-02. [^34]: When checking an LDAPS chain, Cisco advises confirming that the root certificate's Issuer and Subject match and that no certificate in the chain has expired. Source: [Troubleshooting Guide for Cisco Unified Communications Manager, Release 12.5(1) - Cisco Unified Communications Manager System Issues](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/trouble/12_5_1/cucm_b_troubleshooting-guide-1251/cucm_b_troubleshooting-guide-1251_chapter_011.html), Issues with LDAP Over SSL, Recommended Action. Checked 2026-10-02. [^35]: Cisco verifies an LDAPS setup by checking that end users appear under User Management > End User and that a synchronized user can log in to the ccmuser page. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Verify section. Checked 2026-10-02. [^36]: Collecting Unified CM logs with file get activelog requires an external SFTP server that is configured and reachable. Source: [Collect CUCM Logs if RTMT Is Not Accessible or Available](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/211351-Collect-Communication-Manager-Logs-via-t.html), Prerequisites / log collection introduction. Checked 2026-10-02. [^37]: The default maximum number of LDAP directories (sync agreements) in Unified CM is 20, adjustable through the Cisco DirSync service parameters. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Customize LDAP Agreement Service Parameters, Maximum Number of Agreements. Checked 2026-10-02. [^38]: The Cisco DirSync service parameters set a default maximum of 3 LDAP hosts per agreement. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Customize LDAP Agreement Service Parameters, Maximum Number of Hosts row. Checked 2026-10-02. [^39]: An LDAP synchronization agreement cannot be edited once its initial synchronization has occurred. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), LDAP Synchronization Overview, note on edits after initial sync. Checked 2026-10-02. [^40]: When authentication uses Active Directory Global Catalog servers on port 3268, the employeeNumber attribute must be added to the Global Catalog manually. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), User Authentication with LDAP, Global Catalog note. Checked 2026-10-02. [^41]: With LDAP synchronization, user data from the LDAP store is copied into the corresponding Unified CM database fields on a schedule, and the corporate directory remains the central repository. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), User Provisioning with LDAP Synchronization. Checked 2026-10-02. [^42]: Passwords of users imported from LDAP are authenticated against the corporate directory with a simple bind, while locally configured users authenticate against the Unified CM database. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), User Authentication with LDAP. Checked 2026-10-02. [^43]: Unified CM uses a single LDAP authentication configuration for the whole cluster. Source: [Preferred Architecture for Cisco Collaboration 14 Enterprise On-Premises Deployments, CVD - Call Control](https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Collaboration/enterprise/14/collbcvd/control.html), User Authentication with LDAP. Checked 2026-10-02. [^44]: After Cisco Tomcat is restarted, users sometimes fail to synchronize over the secure port, and Cisco states the Cisco DirSync service must then be restarted for synchronization to succeed. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Directory Synchronization, note after Use TLS step. Checked 2026-10-02. [^45]: After uploading LDAPS trust certificates, Cisco Tomcat is restarted from each node's CLI with utils service restart Cisco Tomcat. Source: [Configure CUCM for Secure LDAP (LDAPS)](https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/215437-configure-cucm-for-secure-ldap-directory.html), Configure section, restart Tomcat step. Checked 2026-10-02. [^46]: In an LDAP string filter the characters asterisk, left parenthesis, right parenthesis, backslash and NUL must be escaped as \2a, \28, \29, \5c and \00. Source: [Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters](https://www.rfc-editor.org/rfc/rfc4515.html), Section 3, String Search Filter Definition. Checked 2026-10-02. [^47]: RFC 4515 filters combine conditions with & (AND), | (OR) and ! (NOT), and each filter is enclosed in parentheses. Source: [Lightweight Directory Access Protocol (LDAP): String Representation of Search Filters](https://www.rfc-editor.org/rfc/rfc4515.html), Section 3, ABNF (filter, and, or, not). Checked 2026-10-02. [^48]: The Release 15 Security Guide says that if the LDAP certificate is renewed, the administrator must restart the SSOP-Tomcat service for user authentication to work. Source: [Security Guide for Cisco Unified Communications Manager, Release 15 and SUs - Identity Management](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/security/15_0/cucm_b_security-guide-release-15/cucm_m_identity-management.html), Identity Management > LDAP Authentication, note. Checked 2026-10-02. [^49]: LDAP agreement service parameters are edited under System > Service Parameters by selecting the publisher and the Cisco DirSync service. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Customize LDAP Agreement Service Parameters, procedure. Checked 2026-10-02. [^50]: Practitioners report that after a user ID is changed in Active Directory, a full sync may not update the Unified CM user ID (breaking Extension Mobility login), and that restarting Cisco DirSync then running a full sync again resolved it (field report). Source: [Call Manager LDAP new user ID not synced](https://eltonoverip.com/blog/2014/06/call-manager-ldap-new-user-id-not-synced/), whole post. Checked 2026-10-02. [^51]: Users to be synchronized must have email ID fields in Active Directory that are either unique or left blank. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), LDAP Synchronization Prerequisites, note. Checked 2026-10-02. [^52]: In the LDAP Directory configuration, a secure connection to the LDAP server is selected by checking Use TLS next to the server hostname or IP address. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Directory Synchronization, LDAP server information steps. Checked 2026-10-02. [^53]: The Unified CM User ID field is populated from whichever corporate directory attribute the administrator selects in the LDAP Attribute for User ID drop-down list. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Enable LDAP Directory Synchronization, step 4. Checked 2026-10-02. [^54]: Each LDAP Directory agreement synchronizes either Users Only or Users and Groups. Source: [System Configuration Guide for Cisco Unified Communications Manager, Release 15 and SUs - Configure LDAP Synchronization](https://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/admin/15/systemConfig/cucm_b_system-configuration-guide-15/cucm_b_system-configuration-guide-14_chapter_011011.html), Configure LDAP Directory Synchronization. Checked 2026-10-02.