Multiple AD with CUCM and authentiation

[viraj0raut]

Hello,

We have a deployment that has multiple ADs <5, each with a different domain.

CUCM supports LDAP sync from 5 sources. Can we use this so that CUCM synchronizes with the ADs and authentication uses SSO.

Customer has SSO service from a provider.

Any pointers or whitepapers will be a great help.

Regards

Viraj

[IngoJuergensmann]

Hi Viraj!

You question indicates that you are running on an older version of CUCM. In newer CUCM versions you can have more than 5 LDAP directories. Currently our CUCM 10.5 has 11 LDAP connections.

However you can only have one LDAP directory connection for authentication (at least in 10.5, don't know about 11.x).

If you want to have users authenticate from multiple ADs/LDAPs, you will need some kind of metadirectory inbetween. We have evaluated ESTOS Metadirectory, but the decision was back then to go with two separated CUCM installations and a common Prime License Manager for both installations.

No idea how SSO relates to this.

[viraj0raut]

Thank you, this is a great help.

We plan to use the multiple LDAP sources functionality of CUCM 10.x onward. However since authentication on CUCM LDAP config can only authenticate with one source, we plan to use SSO feature in CUCM to authenticate users from the various ADs using a single iDP such as ADFS.

Regards

Viraj

[Drazen Juran]

Hello,

You can use multiple AD authentication but you need to use LDAP PROXY.

All connections for authentication to go through a proxy LDAP and LDAP sync goes directly to the AD controller server. You can try for example: https://www.netiq.com/products/ldap-proxy/ . We use custom made LDAP PROXY and it work perfect.

Regards

Drazen