Can We do LDAP searching or editing?

[Peter Schober]

* Saurabh Tyagi <saurabh.tyagi at thepsi.com> [2013-07-06 08:13]:
> In my scenario, I have successfully authenticated from Idp and
> logged in my application with required attributes.
> 
> Now, I want to do some LDAP operations such as searching  or editing the
> LDAP profiles, (LDAP is at IDP end and not accessible to me directly)

The Shibboleth SP will give you an identifier for the subject (via
REMOTE_USER or any other mapped attribute) so you know for whom to
search.
Other than that: The Shibboleth SP has nothing to do with LDAP and
certainly doesn't limit you in accessing LDAP DSAs from your
application in any way, via any language or API of our choice.

If you're asking for (non-web-)SSO to an LDAP directory based on the
identity of the subject present at your webserver, the answer is
basically no. (Though there's one expired I-Ds and one RFCs at the
IETF for bridging SAML and SASL, plus the ABFAB WG. All of this is way
beyond simply deploying and configuring existing software packages.)

There are alternatives, though. If you replace the Shibboleth SP with
mod_mellon (or hack it to make use of mod_shib) you should be able to
achive that using CrudeSAML, according to its documentation.

That's all outside of the Shibboleth project and software and hence
also this mailing list, of course.
-peter