Question on Login Handlers

[Kevin P. Foote]

On Thu, 22 Aug 2013, Christopher Bongaarts wrote:

> On 8/22/2013 3:17 PM, Brewer, Edward L wrote:
>> 
>> I am currently running a 2.3.6 IdP Instance on JBOSS 5 (RHEL 5) that is 
>> configured for UserPassword and PreviousSession for the login handlers.  I 
>> have JAAS configured correctly to use one of our LDAP sources (it is in 
>> production and working correctly).  I was just handed a requirement to 
>> integrate with an application that wants to authenticate against a 
>> differing version of LDAP.  I read through the section on JAAS 
>> configuration and felt confident I could stack the LDAP servers in the 
>> configuration to allow for auth to either service. However, this new LDAP 
>> that I am adding is a superset of the current system.  More precisely, when 
>> we add a new user to our system we add that user in LDAP1(currently 
>> configured) and LDAP2(want to add).  We keep these systems in sync for the 
>> user while they are here.  When they leave, we disable the user in LDAP1 
>> (but leave their entry) and stop updating LDAP2.  So the user is in both 
>> but is only able to login to LDAP2.  Now, the concern is that if a user 
>> leaves and now is able to login to LDAP2, they will be able to get access 
>> to an application that assumes they are enabled in LDAP1.  I have been 
>> given till tomorrow to dream up a way to ensure that if a user is auth'ed 
>> in LDAP2 that they will not be allowed in any of the current applications 
>> that are configured now.
>> 
>
> One possibility would be to use two login handlers, one configured for LDAP1 
> (default) and one for LDAP2 (selectable with a particular authentication 
> method you dream up).  Then ask the new app to request that authentication 
> method (or define a separate RelyingParty for them with that as their default 
> auth method).
>
> Disclaimer:  I don't use the UserPassword/JAAS so I apologize if there are 
> limitations that prevent this from working...

I think Chris is right on the front side.. your LDAP2 specific app could
request a special handler. But, the PreviousSession
handler is where things run into issues and your LDAP2 group will have
access to stuff they should not.

------
thanks
  kevin.foote