Shibboleth and LDAP

[Raper, William]

Scott

Thank you for your reply. I really appreciate it.

I do have one more question:  Do you have an awareness of a product or a process that would provide the "LDAP Proxy" functionality between Shibboleth and an LDAP-based application?  Let's make the assumption for the moment that the product does not use Web SSO protocols.

Thank you.

Bill Raper

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, January 28, 2013 3:32 PM
To: Shib Users
Subject: Re: Shibboleth and LDAP

On 1/28/13 3:07 PM, "Raper, William" <braper at iccohio.com> wrote:

>I am getting ready to work on a POC at an educational institution that 
>has standardized on Shibboleth. The product that we are going to work 
>with is IBM¹s Infosphere Information Server (DataStage and QualityStage).
> 
>This product authenticates using LDAP.
> 
>On the web page for Shibboleth Identity Provider, it lists under the 
>Key Features ³Out of the box support for LDAP, Kerberos, web server and 
>Servlet Container based authentication systems².
> 
>Does this mean that Shibboleth Identity Provider will use an LDAP store 
>as a source of users to authenticate, or that it will act as a proxy 
>for applications that use the LDAP protocol?

The former. Applications that directly use LDAP are not necessarily able to use Web SSO protocols. The issue is that some applications are truly pluggable for authentication and some are pluggable for password validation. Directly accessing LDAP is in part the latter. SSO means the application never sees the password (and should never ask for it either).

>Can you point me to papers or instructions or discussions having to do 
>with this functionality?

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverLDAPDataConnec
tor

More generally, just search for LDAP.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net