IDPv3.1.2 LDAP connector: using two distinct LDAP servers?

[Brady, Jason W]

Maybe this has to do with using the FormatDnResolver with the AggregateDnResolver and not using PooledSearchDnResolver for both. It looks like FormatDnResolver always succeeds so the AggregateDnResolver$AuthenticationHandler will always try and authenticate them. Effectively, all accounts exist to the FormatDnResolver, even when they don't exist in the directory.

Our setup (and the Multiple Directories example, and the Multiple AD example) uses the PooledSearchDnResolver for both directories, and when a search fails against one of the directories, it never tries to authenticate them against that directory.

How should it handle a positive resolution from both directories but for one directory login succeeds and the other fails? It looks like it says if any fail, they both fail. I forget if that was the exact result when it happened with JAAS, but it looks like it is a similar problem.

Jason Brady * Web Developer * San Bernardino Community College District *
1289 Bryn Mawr Ave, Suite B, Redlands, CA 92374 *
Tel 909-384-8691 * Mobile 951-295-9515 * Fax 909-796-6579 * jbrady at sbccd.cc.ca.us<mailto:jbrady at sbccd.cc.ca.us>

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Raymond Gardner
Sent: Thursday, June 30, 2016 4:43 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDPv3.1.2 LDAP connector: using two distinct LDAP servers?

Well, that ExamplefortwoActiveDirectorieswithtwoDNResolversforeach is a very involved configuration.  I have not noticed that before.

Mine is kind of similar, but different.  The one big difference for me is, I'm not using two Active Directory LDAP instances.
I'm using one Active Directory LDAP instance and one OpenLDAP instance.  So, I have one using 'adAuthenticator' and one using 'bindSearchAuthenticator'.
Maybe I have something misconfigured.

The behavior I observe is:

-          login1 - exists in LDAP1, which is OpenLDAP instance

-          login2 - exists in LDAP2, which is Active Directory instance

Authentication for login1 fails:

o   Successful authentication against LDAP1

o   Failed authentication against LDAP2

Authentication for login2 succeeds:

o   Successful authentication against LDAP1 - I don't understand this; this should not be successful as this user does not exist in this LDAP instance; I'm positive

o   Successful authentication against LDAP2
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160705/c54e45ff/attachment.html>