A scenario to lookup Active Directory attributes

[Cantor, Scott]

On 10/9/13 7:59 AM, "Rikard Braathen" <rikard.braathen at gmail.com> wrote:
>
>What would be the procedure or best practise to accomplish this? Would I
>need to also install Shibboleth IdP in order to make the lookup to the
>AD? The external IdP can't talk to the internal AD.

The SP has no LDAP support, the only built-in additional lookup capability
is in a plugin that issues SAML queries. So you have three choices:

- do it in your application
- stand up a SAML attribute authority such as Shibboleth to access the AD
and issue queries to it
- write a C++ plugin to the SP supporting LDAP

Or the fourth of course, use a different SAML SP implementation that does
account linking to AD. ADFS for example can do this.

-- Scott