Attributes and multiple LDAPs

[David Bantz]

Our IdP uses multiple LDAP directories for redundancy and harvesting attributes that are in one but not other sources.
That is, the IdP authenticates users against multiple directories and regards the user as authenticated as long as one bind attempt succeeds. 
I have verified that even if authentication fails against one of those sources, the attributes for that identity are available, and that has met our needs up to now.  (That is, the IdP retrieves, say, specific entitlements and campus affiliation from one source, and group memberships from another. And I get both sets of attributes even if authentication fails in one of those sources.) 

I am now looking at a new need, in which users will have records in 1, 2, or 3 directories.  The username will be the same, but the passwords generally different.  In this new scenario, though, we expect a key single-valued attribute to have a different value in each instance. 

What happens if two different LDAP sources return different values of a single-valued attribute?  Are they distinguishable within the attribute-resolver processing if I just specify different attribute resolver dependencies:

  <resolver:AttributeDefinition id="employeeNumber1" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        sourceAttributeID="employeeNumber">
        <resolver:Dependency ref="LDAP1" />...

  <resolver:AttributeDefinition id="employeeNumber2" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
        sourceAttributeID="employeeNumber">
        <resolver:Dependency ref="LDAP2" />...

so that I might pass 2 differently labeled SAML attributes?

What would be more useful would be to resolve values from ONLY the LDAP directory source(s) which successfully authenticated the user.  Is that something that could be readily configured or scripted in the IdP?

David Bantz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130322/d05793a0/attachment.html