Confused Attribute DataConnector vs. JAAS

[Kevin P. Foote]

On Tue, 15 Oct 2013, Joaquin Menchaca wrote:

> If I understand correctly, the JAAS is the back-end authentication
> system you can configure to LDAP, Kerberos, etc.  To use JAAS, I would
> have to uncomment the section in the handler.xml?

You might have figured this all out by now.. due to your other messages.

Yes, JAAS connects your Java servlet to your back-end authentication system of 
choice: LDAP, RDBMS, etc..

To make use of a particular LoginHandler yes you uncomment ex: UsernamePassword
or define a-new in your handler.xml file.  You don't uncomment JAAS per-say.

OOB the Shib-IdP ships with a LDAP backed JAAS setup. [1]

> How does this relate to the resolver:dataconnectors in the
> attribute-resolver.xml?

DataConnector(s) are defined in your attribute-resolver file.  You may have any
number of connectors and they can connect to the same LDAP or DB that your 
JAAS connection goes to or an altogether different one. [2]

HTH

[1] <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass>
[2] <https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAddAttribute>

------
thanks
  kevin.foote