attribs from db what jaas uses

[Peter Schober]

* Szerb, Tamas <toma at rulez.org> [2014-06-24 00:34]:
> I'm lanning to introduce LDAP auth& attrib resolution, but I'd like
> to know how it is possible to not confuse the backends, so I'd like
> to make sure that the attributes will be resolved from the database
> which it was authenticated against?

So you want to use both JDBC and LDAP in both the JAAS modules as well
as the IDP's data connectors in the attribute resolver /and/ the same
identifier in those systems refer to different people? Not a good idea.

I think then the question is whether you can identify the specific
JAAS module used to authenticate a principal. Because if that's
possible (and I don't know that) you could possibly create two
different kinds of principals/subjects and let each have seperate
dependencies (ultimately to the different data connectors) in the
resolver. Though I think that would also require duplicates of all
attribute definitions, not pretty in any case.

And of course you'll have the same problem for the next application
that comes along and needs to be aware of both the subjects in your
RDBMS and LDAP systems. So solving that outside the IDP will be
benefitial anyway and will make obsolete all kinds of weird
workarounds such as the one suggested above.
-peter