One IdP serving separate security (LDAP) domains

[Daniel Fisher]

On Fri, Apr 5, 2013 at 1:26 PM, Mosior, Benjamin <BEMosior at ship.edu> wrote:

> Scott,
>
> I'll attempt to explain what I mean.
>
> >From a design perspective, unnecessary complexity introduces the
> potential for additional points of failure (such as overlapping usernames
> and multiple SSL certificates to maintain [if LDAPS]), not to mention how
> much more involved troubleshooting can become. As detailed as the
> documentation is, Shibboleth still ends up being something of a monolith at
> first approach for the inexperienced or overloaded. For that reason, I
> advocate simplicity in the overall system design if possible. Of course,
> changing an existing system can be difficult in some circumstances, so if
> the complexity issue can be handled by a workaround (such as the failover
> method for cross-domain authentication in the IdP), that's wonderful.
>
> As far as performance, the Shibboleth IdP certainly does an excellent job
> of minimizing the issue. However, consider the scenario where the IdP is
> offered as part of a SaaS hosting project. The IdP is hosted by a vendor,
> while the authentication backend still resides at the client site. The
> inherent connection latency and SSL negotiation times become noticeable
> when the number of binds double because two LDAPS connections need to be
> made for authn (four, if attribute retrieval is included). The same sorts
> of issues may appear if 'x' number of JAAS configurations are chained
> together. By the time it hits the final mechanism, a login failure's return
> time may very well be atrocious.
>

If you want pooling in the JAAS layer you can try this module:
http://www.ldaptive.org/docs/guide/jaas#TOC-Pooling
If you decide to give it a try, please report back. (I've not tested it in
v2...)
I'm curious as to the real world performance gains as well.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130405/0010701a/attachment.html