Shibboleth Identity Provider 3.2.1 custom authentication configuration

[Cantor, Scott]

> Yell at the SP? ;-)
> [Raymond Gardner] I am also the SP.  Yelling at myself will not impress my
> boss.

Then you've created a problem and you can solve it. SPs have no business creating unusual authentication requirements at the IdP. You should start from first principles and rethink what it is you're doing that requires you to force the IdP to do all this.

> I have not tried JAAS but I feel I will still have issues with a database lookup
> running in-between the "stacked" LDAP instances.

Yes, that doesn't work. So stop requiring that. See above.

> There's simply nothing like this out of the box.
> [Raymond Gardner] I was thinking I could extend the Transforms bean and
> provide a DBTransforms bean.

It doesn't work like that. The bean is just a regular expression/replacement pair. It's data, not behavior. The behavior is hardwired into a class you can't change.

-- Scott