attribs from db what jaas uses

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2014-06-24 10:18]:
> So you want to use both JDBC and LDAP in both the JAAS modules as well
> as the IDP's data connectors in the attribute resolver /and/ the same
> identifier in those systems refer to different people? Not a good idea.

Going even further, if you have identical identifers in the RDBMS and
in LDAP and they refer to different subjects (persons), then you
cannot have both JDBC and LDAP JAAS modules active at the same time.

The IDP would need to iterate over all JAAS modules (i.e., submit the
credentials supplied to the IDP to each module until one succeeded)
and the only thing preventing subject A (with identifer "foo" in the
RDBMS) from logging in as subject B (with identifer "foo" in LDAP)
would be the password. So you'd need to enforce that the passwords
for those two subjects using the same identifier cannot be identical,
otherwise both subjects would end up using the account from the system
defined first in the JAAS module stack (i.e., someone would
authenticate corretly and be represented as a different person).

And if you could prevent passwords in the RDBMS from being identical
from passwords in LDAP (for the same identifier) you could also have
prevented identical identifiers in those systems from being assigned
to different subjects in the first place.

So this is not about attriute resolution in the IDP at all, IMO, you
can't even perform authentication properly that way.
-peter