One IdP serving separate security (LDAP) domains

[Alan Angulo (live@edu admin)]

The IdP is now providing authentication for the 2 separate LDAP directories (2 Microsoft Active Directories).
The login.config had to be tweaked so that the second LDAP setting would contact a global catalog on port 3268.
I have attached an image of the actual setup.
Below is also the actual login.config that made it work.
(Kudos to Benjamin Mosior who was able to provide the actual solution):

//STUDENT Domain Configuration  
 edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      host="gc1.myUniv.edu"
      port="389"
      base="CN=Users,DC=esu,DC=edu"
      tls="false"
      serviceCredential="**********"
      userRoleAttribute="sAMAccountName"
      serviceUser="studentquery at myUniv.edu"
      subtreeSearch = "false"
      userField="samAccountName";

//ADMINISTRATION Domain Configuration
   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      host="gc1.administration.myUniv.edu"
      port="3268"
      base="DC=administration,DC=esu,DC=edu"
      tls="false"
      serviceCredential="**********"
      userRoleAttribute="sAMAccountName"
      serviceUser="employeequery at administration.myUniv.edu"
      subtreeSearch = "true"
      userField="samAccountName";

---
Thank you for your feedback
Sincerely

--Alan Angulo
Systems Administrator
East Stroudsburg University

________________________________________
From: users-bounces at shibboleth.net [users-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Wednesday, April 03, 2013 3:09 PM
To: Shib Users
Subject: Re: One IdP serving separate security (LDAP) domains

On 4/3/13 2:57 PM, "Alan Angulo (live at edu admin)" <alan at live.esu.edu>
wrote:

>I'm trying to setup one IdP to serve 2 separate security domains (ex.
>DOMX.EDU and DOMY.EDU).

The software doesn't know about domains as a concept, so there's something
you mean by it that you'll have to be more explicit about.

>I followed the documentation for IdPMultipleLDAP
>(https://wiki.shibboleth.net/confluence/display/SHIB2/IdPMultipleLDAP)
>but that applies only to multiple LDAPs in the same security domain.

I don't think it has anything to say about the question. Skimming it, I
don't see how it would be any different apart from the details that will
be totally specific to any site's needs.

One issue I can think of that you might mean would be that usernames in
your two directories aren't unique. In that event, I would guess you
either have to require users to enter the domain as part of the username,
or you need two IdPs.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: login_config.jpg
Type: image/jpeg
Size: 43881 bytes
Desc: login_config.jpg
Url : http://shibboleth.net/pipermail/users/attachments/20130405/45184e09/attachment-0001.jpg