Choose LDAP server based on SP name

Robo Burned robo at list.ru
Thu Nov 26 05:02:45 EST 2015


In my test environment I need emulate work of two IdPs. SP will have a page where user will select the IdP to login with.
I don't want to have two installations of shibboleth so I would like to build the following:
One IdP will be available by two URLs like  http://institute1.org/shib/     http://institute2.org/shib
SP will redirect user to one or another URL passing different values of Issuer field.
IdP will have two SPs configured and will act differently depending on what SP entity Id it got in SAML request.
I see no issues here.
IdP is connected to ApacheDS. ApacheDS has users for both institutes. Users sits in different OU (organisation unit)
So I need a wat to choose LDAP options for authentication depending on SP name.
I have: 
idp.authn.LDAP.dnFormatOrg1= uid=%s, OU=org1_Users
 idp.authn.LDAP.dnFormatOrg2= uid=%s, OU=org2_Users 
I am looking at activation conditions:
https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions
https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAttributePluginActivationConditions
I see they can be applied to Data Connectors but I don't know how to use it in ldap-authn-config.xml
I expected to add two conditions and use them to choose formatDnResolver bean.
<!-- Format DN resolution -->
    <bean id="formatDnResolver" class="org.ldaptive.auth.FormatDnResolver" p:format="%{idp.authn.LDAP.dnFormatOrg1:undefined}" p:activationConditionRef="org1SPCondition" />
 <bean id="formatDnResolver" class="org.ldaptive.auth.FormatDnResolver" p:format="%{idp.authn.LDAP.dnFormatOrg2:undefined}" p:activationConditionRef="org2SPCondition" /> 
<!-- Single SP -->
<bean id="MyCondition" parent="shibboleth.Conditions.RelyingPartyId"
    c:_0="#{{'https://institute1.org/shib'}}" />
This bean seems not hav  activationConditionRef attribute. It looks like it is shibboleth feature that is not possible in ldaptive's sections.
So the question is Could I have different LDAP parameters for authentication for different SPs?

Robo Burned
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151126/1687dd01/attachment-0001.html>


More information about the users mailing list