A scenario to lookup Active Directory attributes

[Kevin P. Foote]

On Wed, 9 Oct 2013, Rikard Braathen wrote:

> 1. User accesses a protected resource
> 2. Shibboleth SP redirect to external IdP
> 3. login through external IdP gives username at email.com
> 4. Would it be possible to HERE make a lookup to Active Directory, search
> for the username at email.com and retrieve the SAMAccountName together with
> the groups that the mailaddress (user) belongs to?
>
> What would be the procedure or best practise to accomplish this? Would I
> need to also install Shibboleth IdP in order to make the lookup to the AD?
> The external IdP can't talk to the internal AD.

It is a bit unclear but I'm guessing that you are the SP operator here.

I do not think an additional IdP is what you are looking for..

It is really up to you how you do any additional account linking on the back 
end of your app. If you want to further query a directory then that is up to 
the business logic found in your app. You certainly have some of the info you 
need to do this in your scenario above arriving from the external IdP ..IE the 
"username at email.com" identifier.

HTH

------
thanks
  kevin.foote