Shibboleth and LDAP

[Cantor, Scott]

On 1/28/13 3:07 PM, "Raper, William" <braper at iccohio.com> wrote:

>I am getting ready to work on a POC at an educational institution that
>has standardized on Shibboleth. The product that we are going to work
>with is IBM¹s Infosphere Information Server (DataStage and QualityStage).
> 
>This product authenticates using LDAP.
> 
>On the web page for Shibboleth Identity Provider, it lists under the Key
>Features ³Out of the box support for LDAP, Kerberos, web server and
>Servlet Container based authentication systems².
> 
>Does this mean that Shibboleth Identity Provider will use an LDAP store
>as a source of users to authenticate, or that it will act as a proxy for
>applications that use the LDAP protocol?

The former. Applications that directly use LDAP are not necessarily able
to use Web SSO protocols. The issue is that some applications are truly
pluggable for authentication and some are pluggable for password
validation. Directly accessing LDAP is in part the latter. SSO means the
application never sees the password (and should never ask for it either).

>Can you point me to papers or instructions or discussions having to do
>with this functionality?

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnec
tor

More generally, just search for LDAP.

-- Scott