attribs from db what jaas uses

[Szerb, Tamas]

OK, let me clarify the use case.

1) Authenticate against database
2) If no user there, try to authenticate against LDAP
3) if succeeded, then fetch the attribute from the data source where the
user authenticated.

After investigating Shibboleth and the common practices (and other
products), I think that would be the appropriate approach, since the IdP
could be the common place where all the data aggregations would happen.

Each SP can be configured to use only one IdP, so the method of using
different user/attrib stores would be up to the Shibboleth.

Maybe I'm wrong, but then please advise different way.

Cheers,

Tamas

VWOL
Tamas SZERB <toma at rulez.org>


On Tue, Jun 24, 2014 at 10:32 AM, Peter Schober <peter.schober at univie.ac.at>
wrote:

> * Peter Schober <peter.schober at univie.ac.at> [2014-06-24 10:18]:
> > So you want to use both JDBC and LDAP in both the JAAS modules as well
> > as the IDP's data connectors in the attribute resolver /and/ the same
> > identifier in those systems refer to different people? Not a good idea.
>
> Going even further, if you have identical identifers in the RDBMS and
> in LDAP and they refer to different subjects (persons), then you
> cannot have both JDBC and LDAP JAAS modules active at the same time.
>
> The IDP would need to iterate over all JAAS modules (i.e., submit the
> credentials supplied to the IDP to each module until one succeeded)
> and the only thing preventing subject A (with identifer "foo" in the
> RDBMS) from logging in as subject B (with identifer "foo" in LDAP)
> would be the password. So you'd need to enforce that the passwords
> for those two subjects using the same identifier cannot be identical,
> otherwise both subjects would end up using the account from the system
> defined first in the JAAS module stack (i.e., someone would
> authenticate corretly and be represented as a different person).
>
> And if you could prevent passwords in the RDBMS from being identical
> from passwords in LDAP (for the same identifier) you could also have
> prevented identical identifiers in those systems from being assigned
> to different subjects in the first place.
>
> So this is not about attriute resolution in the IDP at all, IMO, you
> can't even perform authentication properly that way.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140625/d76b94de/attachment.html