IDP : Dynamically choose ldap instance from principal

[Cédric Couralet]

2013/11/5 Peter Schober <peter.schober at univie.ac.at>:
> * Cédric Couralet <cedric.couralet at gmail.com> [2013-11-05 08:09]:
>> I use RemoteUser and let Tomcat handle the authentification with
>> CombinedRealm. Is there a way to do the same thing with shibboleth?
>
> >From what I can see the CombinedRealm does (iterate over several
> directory servers until authentication succseeds, which btw is not
> about finding attributes in the DIT) I don't think the LDAP
> DataConnector has a simple way of achieving this.

Exactly. My users are dissemined accros different ldap server, and I
want only one IDP for all. I know how I can go about authentification
(with Tomcat). My problem was with getting the attributes from the
specific ldap server.

> For the RDBMS DataConnector you'd probably set noResultIsError=true
> and define failover DataConnectors. From the docs it looks as Failover
> DataConnectors are not available for LDAP DCs, though?
>
> If the search bases where identical but you wanted to search several
> DSAs maybe specifying all of the servers as a list in the DC's ldapURL
> attribute would do, also setting noResultIsError=true. Not sure the
> error thrown by noResultIsError=true is the same condition which makes
> the LDAP DC try the next server in the ldapURL list.

Thank you, I would not have thought of this. I'll try it and see if it helps.

> The other thing that comes to mind is having one LDAP DC for each
> server (or search base/scope or whatever you consider a "Realm" or
> "Subrealm" in the Tomcat example) and make each attribute definition
> depend on all DCs, but that sounds rather inefficient to me (as all
> DCs would be hit each time for each attribute for each users).
> If users existed in more than one such DC you'll also want to set
> mergeResults=true, I suppose.