IDPv3.1.2 LDAP connector: using two distinct LDAP servers?

[Daniel Fisher]

On Tue, Jul 5, 2016 at 1:12 PM, Brady, Jason W <jbrady at sbccd.cc.ca.us>
wrote:

> Maybe this has to do with using the FormatDnResolver with the
> AggregateDnResolver and not using PooledSearchDnResolver for both. It looks
> like FormatDnResolver always succeeds so the
> AggregateDnResolver$AuthenticationHandler will always try and authenticate
> them. Effectively, all accounts exist to the FormatDnResolver, even when
> they don’t exist in the directory.
>

That's correct. The FormatDnResolver will always succeed and because it
succeeds the fastest, it's authentication handler will always be the one
invoked. Use a SearchDnResolver so your directories can be logically
separated.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160705/c75a2901/attachment.html>