Question on Login Handlers

[Brewer, Edward L]

To all,

I am currently running a 2.3.6 IdP Instance on JBOSS 5 (RHEL 5) that is configured for UserPassword and PreviousSession for the login handlers.  I have JAAS configured correctly to use one of our LDAP sources (it is in production and working correctly).  I was just handed a requirement to integrate with an application that wants to authenticate against a differing version of LDAP.  I read through the section on JAAS configuration and felt confident I could stack the LDAP servers in the configuration to allow for auth to either service. However, this new LDAP that I am adding is a superset of the current system.  More precisely, when we add a new user to our system we add that user in LDAP1(currently configured) and LDAP2(want to add).  We keep these systems in sync for the user while they are here.  When they leave, we disable the user in LDAP1 (but leave their entry) and stop updating LDAP2.  So the user is in both but is only able to login to LDAP2.  Now, the concern is that if a user leaves and now is able to login to LDAP2, they will be able to get access to an application that assumes they are enabled in LDAP1.  I have been given till tomorrow to dream up a way to ensure that if a user is auth'ed in LDAP2 that they will not be allowed in any of the current applications that are configured now.

Hope this makes sense,

Lee Brewer | Directory Services Architect | Information Technology | Vanderbilt University
lee.brewer at vanderbilt.edu | phone 615.343.2802 | it.vanderbilt.edu<http://it.vanderbilt.edu/>
[Vanderbilt IT logo]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130822/75b16b6c/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 7677 bytes
Desc: image002.jpg
Url : http://shibboleth.net/pipermail/users/attachments/20130822/75b16b6c/attachment.jpg