Multiple Unique LDAP configuration Issue

[Peter Schober]

* Negib A. Sherif <aa8288 at wayne.edu> [2016-01-08 17:24]:
> I have Shibboleth 2.4 setup and working with LDAPs authentication.

If you're only starting out you should start with a current (i.e., 3x)
IDP release, of course.

> 1) login.config file has:
> 
>  edu.vt.middleware.ldap.jaas.LdapLoginModule required
>       ldapUrl="ldap://LocalLDAP.lib.wayne.edu:636"
>       baseDn="dc=LocalLDAP,dc=lib,dc=wayne,dc=edu"
>       bindDn="bindDninfo"
>       bindCredential="password"
>       ssl="false"
>       userFilter="uid={0}";
> 
>   edu.vt.middleware.ldap.jaas.LdapLoginModule required
>       ldapUrl="ldap://RemoteLDAP.wayne.edu:636/ou=People,dc=wayne,dc=edu?uid?one?"
>       baseDn="dc=RemoteLDAP,dc=wayne,dc=edu"
>       bindDn="bindDninfo"
>       bindCredential="password"
>       ssl="false"
>       userFilter="uid={0}";

> Independently, Remote or Local LDAP works fine after commenting out,
> one at a time, the configuration in login.config and
> attribute-resolver.xml files. However, when I enable both Remote and
> Local LDAP configrations as shown above, I can authenticate to
> LocalLDAP if UID exist in LocalLDAP. When I try with UID that exist
> in RemoteLDAP but not in LocalLDAP, I get the usual login failed
> error message. For RemoteLDAP UID, the search stops at LocalLDAP and
> then genrates login failed error message.

You'll need to change the JAAS configuration flags (you have both as
"required". above) then:
  "The overall authentication succeeds only if all Required and
  Requisite LoginModules succeed."
http://docs.oracle.com/javase/8/docs/api/javax/security/auth/login/Configuration.html

> There is no error in idp-process.log file when tomcat6 starts.

Debugging JAAS issues can be difficult.

> Both LocalLDAP and RemoteLDAP binds fine, loads data connectors and
> attribute definitions. see the snippet below from idp-process.log
> file.

Data connectors (and filters) have nothing to do with this.
-peter