LDAP integration features

IBM® Unica Marketing integration with LDAP provides the features described in this section.

IBM® Unica Marketing applications query the Marketing Platform for user authorization information. When LDAP integration is implemented, users enter their valid LDAP user name and password for authentication to IBM® Unica Marketing applications.

The Marketing Platform imports groups and their users from the directory server database through a periodic synchronization task that automatically retrieves information from the directory server. When Marketing Platform imports users and groups from the server database, group memberships are maintained.

You can assign IBM® Unica Marketing privileges by mapping an LDAP group to an IBM® Unica Marketing group. This mapping allows any new users added to the mapped LDAP group to assume the privileges set for the corresponding IBM® Unica Marketing group.

A subgroup inherits the roles, but not the LDAP mappings or user membership, assigned to its parents.

If you do not want to create groups in your LDAP server that are specific to IBM® Unica Marketing products, you have the option to control the users who are imported by specifying attributes. To achieve this, you would do the following during the LDAP configuration process.

This indicates to the Marketing Platform that the synchronization is not based on a group with member references but is based on an Org Unit or an Org.

3.	When you configure the LDAP reference map property, set the Filter portion of the value to the attribute on which you want to search. For the Filter, use the string you determined in step 1.

In the remainder of this chapter, where appropriate, instructions are provided for attribute based synchronization.

You must choose between group based synchronization or attribute based synchronization; both methods are not supported simultaneously.

When you use attribute based synchronization, the periodic synchronization is always a full synchronization, instead of a partial synchronization, which is done for group based synchronization. For attribute based synchronization, you should set the LDAP sync interval property to a high value, or set it to 0 to turn off automatic synchronization and rely on manual full synchronization when users are added to the directory.

In multi-partition environments, user partition membership is determined by the group to which the user belongs, when that group is assigned to a partition. A user can belong to only one partition. Therefore, if a user is a member of more than one LDAP group, and these groups are mapped to IBM® Unica Marketing groups that are assigned to different partitions, the system must choose a single partition for that user.

You should try to avoid this situation. However, if it occurs, the partition of the IBM® Unica Marketing group most recently mapped to an LDAP group is the one that the user belongs to. To determine which LDAP group was most recently mapped, look at the LDAP group mappings displayed in the Configuration area. They are displayed in chronological order, with the most recent mapping listed last.

IBM® Unica Marketing supports two types of user accounts and groups.

Internal – User accounts and groups that are created within IBM® Unica Marketing using the IBM® Unica Marketing security user interface. These users are authenticated through Marketing Platform.

External – User accounts and groups that are imported into IBM® Unica Marketing through synchronization with a supported LDAP server. This synchronization occurs only if IBM® Unica Marketing has been configured to integrate with the LDAP server. These users are authenticated through the LDAP server.

You may want to have both types of users and groups if, for example, you want to give your customers access to IBM® Unica Marketing applications without adding them to your LDAP server as full corporate users.

Using this hybrid authentication model requires more maintenance than a pure LDAP authentication model does.

When IBM® Unica Marketing is configured to integrate with an LDAP server, users and groups are synchronized automatically at pre-defined intervals.