Aggregate Authenticator LDAP multiple directories

[Ioannis Kakavas]

Hello all,

My use case is that the IdP needs to be able to authenticate users
against two different LDAP directories. The tricky part is that users
can be non exclusively in both with the same uid ( but with potentially
different password ). In a sense, we would like the second directory to
act as a fallback. If the password of the user is not correct for
the first directory, the second should be tried.

I have configured the IdPv3.1.2 as stated in
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-MultipleDirectories
( using anonSearch instead of bindSearch )but I get an error because
it finds 2 DNs for the user, one in each directory.

The error is
2015-07-14 23:30:19,054 - WARN
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:212]
- Profile Action ValidateUsernamePasswordAgainstLDAP: Login by
myusername produced exception
org.ldaptive.LdapException: Found more than (1) DN for: myusername

In IDP2 we used to handle this with defining two ds, one sufficient and
one requisite in login.conf as follows :

ShibUserPassAuth {


   edu.vt.middleware.ldap.jaas.LdapLoginModule sufficient
      ldapUrl="url1"
      baseDn="base1"
      tls="true"
      userFilter="uid={0}";

   edu.vt.middleware.ldap.jaas.LdapLoginModule requisite
    ldapUrl="url2"
      baseDn="base2"
      tls="true"
      userFilter="uid={0}";
};


Any suggestions on how this can be achieved using the
aggregateAuthenticator ?


Best Regards,
Ioannis
-- 
-----------------------------------------------------------
Ioannis Kakavas - ikakavas at grnet.gr
Identity and Access Management Engineer
GRNET Network Operations Centre
Greek Research & Technology Network - http://www.grnet.gr
56, Mesogion Av., Ampelokipi, 11527 Athens, Greece
Office: +30 2107474255
------------------------------------------------------------