Question on Login Handlers

[David Langenberg]

On Thu, Aug 22, 2013 at 2:33 PM, Kevin P. Foote <kpfoote at iup.edu> wrote:

>
>
> On Thu, 22 Aug 2013, Christopher Bongaarts wrote:
>
> > On 8/22/2013 3:17 PM, Brewer, Edward L wrote:
> >>
> >> I am currently running a 2.3.6 IdP Instance on JBOSS 5 (RHEL 5) that is
> >> configured for UserPassword and PreviousSession for the login handlers.
>  I
> >> have JAAS configured correctly to use one of our LDAP sources (it is in
> >> production and working correctly).  I was just handed a requirement to
> >> integrate with an application that wants to authenticate against a
> >> differing version of LDAP.  I read through the section on JAAS
> >> configuration and felt confident I could stack the LDAP servers in the
> >> configuration to allow for auth to either service. However, this new
> LDAP
> >> that I am adding is a superset of the current system.  More precisely,
> when
> >> we add a new user to our system we add that user in LDAP1(currently
> >> configured) and LDAP2(want to add).  We keep these systems in sync for
> the
> >> user while they are here.  When they leave, we disable the user in LDAP1
> >> (but leave their entry) and stop updating LDAP2.  So the user is in both
> >> but is only able to login to LDAP2.  Now, the concern is that if a user
> >> leaves and now is able to login to LDAP2, they will be able to get
> access
> >> to an application that assumes they are enabled in LDAP1.  I have been
> >> given till tomorrow to dream up a way to ensure that if a user is
> auth'ed
> >> in LDAP2 that they will not be allowed in any of the current
> applications
> >> that are configured now.
> >>
> >
> > One possibility would be to use two login handlers, one configured for
> LDAP1
> > (default) and one for LDAP2 (selectable with a particular authentication
> > method you dream up).  Then ask the new app to request that
> authentication
> > method (or define a separate RelyingParty for them with that as their
> default
> > auth method).
> >
> > Disclaimer:  I don't use the UserPassword/JAAS so I apologize if there
> are
> > limitations that prevent this from working...
>
> I think Chris is right on the front side.. your LDAP2 specific app could
> request a special handler. But, the PreviousSession
> handler is where things run into issues and your LDAP2 group will have
> access to stuff they should not.
>

Yes, but you could still solve that by making disabled users in LDAP1
invisible to the Attribute Resolver.  They'd then be able to authN, but no
attributes for them would be returned.  Hopefully your downstream apps are
not performing AuthN == AuthZ.

Dave

-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130822/49ede0d5/attachment.html