multiple users directories depending on UPN

Cantor, Scott cantor.2 at
Mon May 5 20:40:18 EDT 2014

On 5/5/14, 8:03 PM, "Mauro Minella" <Mauro.Minella at> wrote:

>I¹ve installed Shib 2.4.0 on Windows. It¹s configured to check user
>credentials against Active Directory, whose details asked by the setup
>wizard (domain/user/pwd) and it works fine.
>Now let¹s assume that users whose UPN ends by should be
>verified by AD, while UPN¹s ending by should be verified
>against an MySQL DB. Is this possible?

JAAS can chain modules together so if fall-through is acceptable for one
or both sets of logins, that can work depending on load. Otherwise you
need a custom login module and some work. The more appropriate way to do
this is with separate IdPs in most cases.

> Is the a guide or something I could leverage for this purpose?

There is nothing beyond the wiki and the contributions people have made of
their own extensions.

-- Scott

More information about the users mailing list