Can Shibboleth IdP handle something like Domain/Group?

[Eric Goodman]

FWIW, I've actually always run different containers for various reasons (e.g., load testing, allowing devs to shell into test envs but not prod ones). I've found that running multiple shib instances is much easier than running and populating the multiple backend datastores that you're likely to need if you have, e.g., test accounts that you don't want in your prod datastore. 

Whether an LDAP, AD, etc. the work we've always run into is around managing that extra datastore. Running the second shib instance has never been that much overhead.

--- Eric

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, July 02, 2013 8:46 PM
To: Shib Users
Subject: RE: Can Shibboleth IdP handle something like Domain/Group?

> When this was proposed to me I hinted at Scott's answer by asking 
> whether it would really be any easier to manage one complex instance 
> rather than five on separate VMs.  The answer seems to be that it is 
> mainly convenient for the server admins; multiple servers for them to 
> administer and update versus one server; the more complex application 
> layer isn't their problem and I was directed to investigate the possibility.

I didn't mean multiple VMs, I said virtualize the IdP. I don't see why you can't have one container running different copies (or multiple containers I suppose).

> And even that seems to still leave the problem of pulling the 
> appropriate set of attributes - that is, the set of "my" attributes 
> from the appropriate repository corresponding the service instance I ask to use.

That's down to creative querying and scripting, but like I said, brittle.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net