authN password source based on requesting party?

[Cantor, Scott]

> On 8/16/16, 9:19 PM, "users on behalf of IAM David Bantz" <users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> wrote:
> 
> >    Is there a way to base the LDAP authN source (this AD/LDAP directory or
> that one) based > on the service making the request? Preferably using jaas.config in v3.
> 
> Not until 3.3 or unless you do the coding.

So, to be explicit, the "coding" involved isn't all that onerous, and I just hadn't really worked out the mechanics of how to plug this in, but I just added some docs on custom back-ends to he Password flow docs. [1]

Others have stumbled on it already, but basically the only thing it takes to implement a back-end for the password flow is defining a Java bean "action" and giving it the right alias. All public/supported.

With pretty minimal Java and using the existing beans as examples, it's certainly possible to cobble up code that would implement a lot of the "edge" cases people ask about, like picking back-ends based on particular criteria, combining/chaining things, etc.

JAAS can certainly do a lot of it, but if you can't use JAAS or want to combine JAAS with other things, or pick a JAAS back-end dynamically, this would work.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/PasswordAuthnConfiguration