One IdP serving separate security (LDAP) domains

[Mosior, Benjamin]

Scott,

I'll attempt to explain what I mean.

>From a design perspective, unnecessary complexity introduces the potential for additional points of failure (such as overlapping usernames and multiple SSL certificates to maintain [if LDAPS]), not to mention how much more involved troubleshooting can become. As detailed as the documentation is, Shibboleth still ends up being something of a monolith at first approach for the inexperienced or overloaded. For that reason, I advocate simplicity in the overall system design if possible. Of course, changing an existing system can be difficult in some circumstances, so if the complexity issue can be handled by a workaround (such as the failover method for cross-domain authentication in the IdP), that's wonderful. 

As far as performance, the Shibboleth IdP certainly does an excellent job of minimizing the issue. However, consider the scenario where the IdP is offered as part of a SaaS hosting project. The IdP is hosted by a vendor, while the authentication backend still resides at the client site. The inherent connection latency and SSL negotiation times become noticeable when the number of binds double because two LDAPS connections need to be made for authn (four, if attribute retrieval is included). The same sorts of issues may appear if 'x' number of JAAS configurations are chained together. By the time it hits the final mechanism, a login failure's return time may very well be atrocious.

The overall conclusion at which I've arrived is that each situation has different requirements, and where possible, a simple, well thought out design is better than kludging each piece together and hoping for the best. 

I am also opinionated, so I'm open to your thoughts on the matter. 

Benjamin Mosior


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, April 05, 2013 10:11 AM
To: Shib Users
Subject: Re: One IdP serving separate security (LDAP) domains

On 4/5/13 3:41 AM, "Mosior, Benjamin" <BEMosior at ship.edu> wrote:
>
>For anyone encountering this scenario in the future:
>1) There are inherent design and performance issues with the failover 
>method. If possible and appropriate, an effort should be made to join 
>the different authentication sources as part of the overall system 
>design (outside of the IdP) or, as Scott mentioned, separate the 
>Shibboleth component such that each authentication source is utilized 
>by a separate IdP.

Can you elaborate? Any well-performing system on the back-end should make that a non-issue. I use failover extensively in both authn and attribute lookup and it works fine.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net