IDP : Dynamically choose ldap instance from principal

[Peter Schober]

* Cédric Couralet <cedric.couralet at gmail.com> [2013-11-05 08:09]:
> I use RemoteUser and let Tomcat handle the authentification with
> CombinedRealm. Is there a way to do the same thing with shibboleth?

>From what I can see the CombinedRealm does (iterate over several
directory servers until authentication succseeds, which btw is not
about finding attributes in the DIT) I don't think the LDAP
DataConnector has a simple way of achieving this.

For the RDBMS DataConnector you'd probably set noResultIsError=true
and define failover DataConnectors. From the docs it looks as Failover
DataConnectors are not available for LDAP DCs, though?

If the search bases where identical but you wanted to search several
DSAs maybe specifying all of the servers as a list in the DC's ldapURL
attribute would do, also setting noResultIsError=true. Not sure the
error thrown by noResultIsError=true is the same condition which makes
the LDAP DC try the next server in the ldapURL list.

The other thing that comes to mind is having one LDAP DC for each
server (or search base/scope or whatever you consider a "Realm" or
"Subrealm" in the Tomcat example) and make each attribute definition
depend on all DCs, but that sounds rather inefficient to me (as all
DCs would be hit each time for each attribute for each users).
If users existed in more than one such DC you'll also want to set
mergeResults=true, I suppose.
-peter