Environment Planning and Design Assistance

[Adam Zheng]

Hello, I am in need a little assistance regarding planning and design.
I am fairly new to Shibboleth, and have been playing around with it for about 3 weeks now.

A project assigned is requesting that Shibboleth be implemented.
This will consist of over 30 remote directories, which will either be AD or OpenLDAP.

Currently, I have setup a Test Shibboleth IdP pointing to our LDAP directory with some Test SP's. Attributes and custom attributes configured are being passed as expected.
I have also setup a Test IdP that is bound with our AD. The attributes are also being passed after configuring it.

I have a few questions that I cannot seem to find after extensive searching.
What is the best solution for this design?

Is it better to have one IdP with 30+ directories or will this cause logins to take forever. Is it even possible to have a mix of AD and LDAP on one IdP.
I've read the docs at https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration but could not determine an answer regarding multiple directories.
Attribute translation would also need to somehow occur, such as sAMAccountName --> uid
We could probably have all the remote directories replicate to our building so latency and schools dropping off the network will not cause an issue.
This is what I am preferring now, as the searchfilter would use mail to find the user, eliminating the need for WAYF DS.

Or, would it be better to have multiple IdP's, one per school. This would end up with over 30 IdP's which sounds like a management nightmare.

Also, is it possible to get multiple IdP's to "trust" eachother?
We will have an IdP (simpleSAMLphp) provided by the state to serve state SP's
Our own Shibboleth IdP will serve specific instances in the region, with regional SP's provided by us.
Both of these IdP's will pull from the same data sources.

Other than setting the SP to accept multiple IdP's, is there a way to configure IdP "trust"
I've read up on some of the relying party docs but don't know if this is the correct thing to read.

To complicate things further (for me at least) Is there a way to configure complex queries?
Currently with CAS, there is an attribute that is passed from the entries group.
The LDAP query will need to perform a query based on an ou entry from the uid, retrieve the information it needs, and construct a new query to return the correct attribute (such as a District ID).
If there is no way to do this, the common attribute could probably just be included with every user record as a workaround.

Any design suggestions will be appreciated.

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160801/9a9db6dc/attachment.html>