Aggregate Authenticator LDAP multiple directories

[Peter Schober]

* Ioannis Kakavas <ikakavas at noc.grnet.gr> [2015-07-15 10:01]:
> My use case is that the IdP needs to be able to authenticate users
> against two different LDAP directories. The tricky part is that users
> can be non exclusively in both with the same uid ( but with potentially
> different password ).

I claim that you can't do that savely. If the two uids happen one day
to also set the same password the subject controlling uid2 could
"become" uid1 and have access to hir data/services.

> In IDP2 we used to handle this with defining two ds, one sufficient and
> one requisite in login.conf as follows :
[...]
> Any suggestions on how this can be achieved using the
> aggregateAuthenticator ?

Not literally, but you could continue to use JAAS for authentication
and thereby use the same login.conf as before.
-peter