group memberships from two sources

[Christopher Bongaarts]

On 3/5/2013 2:18 PM, David Bantz, who is probably experiencing warmer 
weather than me right now, wrote:

> Our IdP uses both a generic LDAP directory and MS Domain AD for
> authentication and attributes.  We've not previously had relying
> services consume group membership; I'm setting that up now, and have a
> couple of questions on which I seek input:

We've been publishing groups via Shib for a while now.  Our current 
setup syncs selected groups from AD into a local attribute 
(umnADMemberOf) in LDAP.  Shib only talks to LDAP, and encodes 
isMemberOf using your method, and umnADMemberOf using a local name 
(https://www.umn.edu/shibboleth/attributes/umnADMemberOf IIRC).

The tradeoff is speed of update propagation vs. hitting two directories 
instead of one for every resolution.  For now, our usage heavily favors 
fewer moving parts.

> Is it appropriate to resolve and release the bare directory attributes

Depends how much you care about the SP learning the structure of your AD 
or LDAP DIT.  We just release the bare attributes, and use the attribute 
filter to control the specific values released to a particular SP.

> Is it appropriate to keep these in separate attributes for release
> (rather than combining them)?

In our case, the answer is currently yes:

- It's less work (both in admin type to define something that combines them)
- Nobody has asked us (yet) for access to both LDAP groups and AD groups 
for the same SP
- If someone did want a combined attribute, it wouldn't be too hard to 
define one, and release it as a separate local attribute 
(umnCombinedMemberOf or something like that)
- Our directory namespaces are distinct (LDAP uses our traditional X.500 
base of o=University of Minnesota,c=US; AD uses a Microsoft- and carpal 
tunnel-friendlier dc=umn,dc=edu) which makes it impractical to import AD 
groups into isMemberOf in LDAP (we also use DSEE).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%