Shibboleth Identity Provider 3.2.1 custom authentication configuration

[Raymond Gardner]

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Friday, July 08, 2016 11:38 PM
To: Shib Users
Subject: Re: Shibboleth Identity Provider 3.2.1 custom authentication configuration

On Fri, Jul 8, 2016 at 12:42 PM, Raymond Gardner <r.gardner at ntta.com<mailto:r.gardner at ntta.com>> wrote:
I looked into an “aggregateAuthenticator” configuration.  Here<https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-AuthenticatorConfiguration> is some good wiki info.
I’m not having any luck getting this to work.  I need a searchDnResolver for LDAP1 but LDAP2 is an AD instance and it is not setup to support searching.
LDAP2 requires a direct bind using the usernamePrime.  (I don’t administer this AD server.  I’m trying to work with it as is.)

I'm confused. LDAP2 is an AD instance. Can the DNs for LDAP2 be resolved using the FormatDnResolver? Or do you have to search a database to resolve them?
[Raymond Gardner] Well, FormatDnResolver works when I use the adAuthenticator against LDAP2 by itself.  But, FormatDnResolver was causing problems with the aggregateAuthenticator.
>The FormatDnResolver will always succeed and because it succeeds the fastest, it's authentication handler will always be the one invoked. Use a SearchDnResolver so your directories can be logically separated. >
>--Daniel Fisher
>…you'll need to obtain a service credential for searching.
>--Daniel Fisher
[Raymond Gardner] Our AD instance isn’t setup for searching.  It requires direct binds.


****************************************************************
This email message is intended for the use of the person to whom it has been sent, and may contain information that is confidential or legally protected. If you are not the intended recipient or have received this message in error, you are not authorized to copy, distribute, or otherwise use this message or its attachments. Please notify the sender immediately by return e-mail and permanently delete this message and any attachments. NTT America makes no warranty that this email is error or virus free. Thank you.
****************************************************************

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160711/8d737f48/attachment-0001.html>