attribs from db what jaas uses

[Cantor, Scott]

> OK, let me clarify the use case.
> 
> 1) Authenticate against database
> 2) If no user there, try to authenticate against LDAP
> 3) if succeeded, then fetch the attribute from the data source where the
> user authenticated.

Then by definition your namespaces have to be unified, making (3) unnecessary. And in any case it's not possible, as several people have noted.

> After investigating Shibboleth and the common practices (and other
> products), I think that would be the appropriate approach, since the IdP
> could be the common place where all the data aggregations would happen.

That isn't really the "normal" advice, the major point of an IDM strategy is to it outside the IdP, but it's hardly uncommon. It still remains unnecessary to guarantee anything about which data source gets checked. You build a failover chain between the two data sources so that it always gets the data and it's fine.

> Each SP can be configured to use only one IdP, so the method of using
> different user/attrib stores would be up to the Shibboleth.

I don't know what that means. It's not true, unless you're talking about your SPs and some particular constraint you have. SPs can use any IdPs they want to.

-- Scott