Can We do LDAP searching or editing?

[Saurabh Tyagi]

Hello Peter,

I wanna ask , can I serach remote LDAP which is not accessible directly. 
Remote LDAP is accessible to IDP only  and not to application.

Can I serach the LDAP through SP/IDP and not accessing it directly using any
API or any thing else.

Thanks for response.


Thanks and Regards
Saurabh Tyagi


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On
Behalf Of Peter Schober
Sent: Saturday, July 06, 2013 4:12 PM
To: users at shibboleth.net
Subject: Re: Can We do LDAP searching or editing?

* Saurabh Tyagi <saurabh.tyagi at thepsi.com> [2013-07-06 08:13]:
> In my scenario, I have successfully authenticated from Idp and
> logged in my application with required attributes.
> 
> Now, I want to do some LDAP operations such as searching  or editing the
> LDAP profiles, (LDAP is at IDP end and not accessible to me directly)

The Shibboleth SP will give you an identifier for the subject (via
REMOTE_USER or any other mapped attribute) so you know for whom to
search.
Other than that: The Shibboleth SP has nothing to do with LDAP and
certainly doesn't limit you in accessing LDAP DSAs from your
application in any way, via any language or API of our choice.

If you're asking for (non-web-)SSO to an LDAP directory based on the
identity of the subject present at your webserver, the answer is
basically no. (Though there's one expired I-Ds and one RFCs at the
IETF for bridging SAML and SASL, plus the ABFAB WG. All of this is way
beyond simply deploying and configuring existing software packages.)

There are alternatives, though. If you replace the Shibboleth SP with
mod_mellon (or hack it to make use of mod_shib) you should be able to
achive that using CrudeSAML, according to its documentation.

That's all outside of the Shibboleth project and software and hence
also this mailing list, of course.
-peter
--
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net