IDP : Dynamically choose ldap instance from principal

Cédric Couralet cedric.couralet at gmail.com
Tue Nov 5 02:09:23 EST 2013


Hello,

I have got several ldap instance, which contains each a subset of
users. I would like to configure an IDP to get all attributes from an
user.

I use RemoteUser and let Tomcat handle the authentification with
CombinedRealm. Is there a way to do the same thing with shibboleth?
Ideally, i would pass it in attribute-resolver.xml. At the moment I
have something like :
<resolver:DataConnector id="myLDAP" xsi:type="dc:LDAPDirectory"
        ldapURL="ldap://host.ldap"
        baseDN="dc=exemple,dc=com"
       >
        <dc:FilterTemplate>
            <![CDATA[
                (uid=$requestContext.principalName)
            ]]>
        </dc:FilterTemplate>
    </resolver:DataConnector>

Is there a way to change ldapURL to a dynamic value (taken from
principal for exemple)?

Is it possible to change DataConnector to do something like this?

--

Cédric


More information about the users mailing list