Multiple LDAP connections

[Peter Schober]

* Prasanna <PVBalachandar at imperosoftware.com> [2014-03-17 14:34]:
> As you said, connecting one idp's to multiple AD's in different environments.

My question was whether that means you intend to make one huge
multi-tennent IDP acting as 300 seperate IDPs. Very different thing
(at least to me) from hooking up one IDP to different LDAP servers.

> Reducing multiple idp's.

300 IDPs into one? I have no experience with this personally (hardly
surprising). Your relying-party.xml would control some of that, I
guess, changing the IDP's entityID based on the entityID of the
SP. Same for the credentials.

Ortner Nikolaus (also on this list) has posted his configuration which
uses a different resolver depending on the relying party (SP), using a
tuned handler.xml, IIRC. Maybe looking at that (in the archive) will
help.

Obviously doing that also has trust/security issues (one IDP having
access to all logical IDPs' private keys) and operational issues
(software/configuration/container/OS updates, cf. clustering
discussions in the documentation and the archives), at the very least.

Alternative approaches you might consider:
* Have multiple IDPs (seperate) in the same servlet container
* Have multiple containers (which one or several IDPs each) on the
  same machine
* Have one virtual machine per IDP.

The latter seems to be more popular today, using configuration
management systems (such as cfengine, puppet, chef, whatever) to
handle installation, updates and changes to many systems
consistently).
-peter