IdPV3 - specify which jaas config to use?

[Brent Putman]

On 2/18/16 3:35 PM, Cantor, Scott wrote:
>> Yes, that's what I meant. Each application uses a different LDAP configuration
>> for password-based login.
>> So there's really no way to select which LDAP to use for each application?
> The IdP doesn't know about applications, only SPs. So assuming that's what you mean, no, there has never really been a way to do that other than duplicating the login mechanism. I wouldn't say that's really a "feature", more a workaround. Duplicating that is more complex in V3 than V2 because the authentication requirements were vastly more complex than what could be achieved before, and the complexity of the system is a reflection of that.
>
> I believe it's tractable to add such a feature directly to the current flow, and would encourage you to file a RFE, but right now duplicating the login flow is the only way, just like duplicating the login handler was the way to do this in V2.

FWIW, our IDM guys here had some weird use case where, based on the
invoking SP, they needed to use a different LDAP directory for authN,
meaning a different JAAS config block. (And simply stacking them with
'sufficient' wasn't an option due to directory overlap.  Don't ask, I
didn't really understand the underlying IDM reasons either.)  I wrote a
V2 extension for them with an updated login servlet which just used a
Spring-wired Map of entityID -> JAAS config name.  So for v2 it was
pretty simple.  They just asked me week before last how to replicate
this type of thing in V3 and it's on my TODO list to look into that.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160218/80b6bede/attachment.html>