Question on Login Handlers

[Christopher Bongaarts]

On 8/22/2013 3:17 PM, Brewer, Edward L wrote:
>
> I am currently running a 2.3.6 IdP Instance on JBOSS 5 (RHEL 5) that 
> is configured for UserPassword and PreviousSession for the login 
> handlers.  I have JAAS configured correctly to use one of our LDAP 
> sources (it is in production and working correctly).  I was just 
> handed a requirement to integrate with an application that wants to 
> authenticate against a differing version of LDAP.  I read through the 
> section on JAAS configuration and felt confident I could stack the 
> LDAP servers in the configuration to allow for auth to either service. 
> However, this new LDAP that I am adding is a superset of the current 
> system.  More precisely, when we add a new user to our system we add 
> that user in LDAP1(currently configured) and LDAP2(want to add).  We 
> keep these systems in sync for the user while they are here.  When 
> they leave, we disable the user in LDAP1 (but leave their entry) and 
> stop updating LDAP2.  So the user is in both but is only able to login 
> to LDAP2.  Now, the concern is that if a user leaves and now is able 
> to login to LDAP2, they will be able to get access to an application 
> that assumes they are enabled in LDAP1.  I have been given till 
> tomorrow to dream up a way to ensure that if a user is auth'ed in 
> LDAP2 that they will not be allowed in any of the current applications 
> that are configured now.
>

One possibility would be to use two login handlers, one configured for 
LDAP1 (default) and one for LDAP2 (selectable with a particular 
authentication method you dream up).  Then ask the new app to request 
that authentication method (or define a separate RelyingParty for them 
with that as their default auth method).

Disclaimer:  I don't use the UserPassword/JAAS so I apologize if there 
are limitations that prevent this from working...

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130822/c89cf4ec/attachment-0001.html