Shib / ldap search base

[Peter Schober]

* Farzan Qureshi <fqureshi at rosmini.school.nz> [2014-10-08 01:16]:
> Thanks for the detailed response. Actually I was thinking you are querying
> multiple base DNs. Actually I don't want to use top level AD forest. I want
> to keep it restricted to three or four OUs. But I believe in your case you
> are using top level base DN and not multiple search base.

The LDAP protocol doesn't have a way to say "search for this in those
3 basedns". You (i.e., the LDAP client) would have to issue 3 seperate
searches in each of those basedns.

I'd probably make sure the service DN used to perform the search does
not have read/search access to the parts of the DIT you don't want it
to search. Then you could still have simple configuration on the
client side (and slightly more efficient than issueing multiple
identical searches with different search bases) but limit the IDP to
specific parts of the DIT.
(If you're performing anonymous binds during the search, well, don't
do that.)
-peter