One IdP serving separate security (LDAP) domains

[Mosior, Benjamin]

To follow-up on this post, I've been working with Alan on getting their cross-domain authentication configured.

On 4/3/13 3:09 PM, "Scott Cantor" <cantor.2 at osu.edu>wrote:
> One issue I can think of that you might mean would be that usernames in
>your two directories aren't unique.

Since they utilize naming schemes that prevent username overlap between the two ADs, we configured each JAAS definition (in the login.config) as "sufficient", which accomplishes the "failover" solution. We had success authenticating users from both domains with this technique.

For anyone encountering this scenario in the future:
1) There are inherent design and performance issues with the failover method. If possible and appropriate, an effort should be made to join the different authentication sources as part of the overall system design (outside of the IdP) or, as Scott mentioned, separate the Shibboleth component such that each authentication source is utilized by a separate IdP.
2) Be sure to verify each individual JAAS configuration independently before attempting to test both at once. Much of our time was spent troubleshooting the one JAAS LDAP/AD configuration, which is a completely separate issue.

Benjamin Mosior