Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[Marco Malavolti]

Hi Daniel and thank you for your availability,

I don't understand how to join the LDAP Authenticator and AD 
Authenticator in a single aggregateAuthenticator that I can use on my 
ldap.properties to perform the authentication of my users.

These are the examples provided by the page you given me (your specific 
link refers to a Multiple openLDAP directory, but in my use case I need 
to use an openLDAP and an Active Directory together):

openLDAP beans:

<!-- ldap.properties "idp.authn.LDAP.authenticator = 
aggregateAuthenticator" -->
<bean name="aggregateAuthenticator" 
class="org.ldaptive.auth.Authenticator">
     <constructor-arg index="0" ref="aggregateDnResolver" />
     <constructor-arg index="1" ref="aggregateAuthHandler" />
</bean>

<bean id="aggregateDnResolver" 
class="org.ldaptive.auth.AggregateDnResolver">
     <constructor-arg index="0" ref="dnResolvers" />
</bean>
<bean id="aggregateAuthHandler" 
class="org.ldaptive.auth.AggregateDnResolver$AuthenticationHandler" 
p:authenticationHandlers-ref="authHandlers" />
<util:map id="dnResolvers">
     <entry key="directory1" value-ref="dnResolver1" />
     <entry key="directory2" value-ref="dnResolver2" />
</util:map>
<util:map id="authHandlers">
     <entry key="directory1" value-ref="authHandler1" />
     <entry key="directory2" value-ref="authHandler2" />
</util:map>

<!-- define DN resolvers and authentication handlers for each 
directory... -->


Active Directory beans:

<!-- ldap.properties "idp.authn.LDAP.authenticator = 
adAggregateAuthenticator" -->
<bean id="adAggregateAuthenticator" 
class="org.ldaptive.auth.Authenticator"
       
p:authenticationResponseHandlers-ref="adAuthenticationResponseHandler">
       <constructor-arg index="0" ref="adAggregateDnResolver" />
       <constructor-arg index="1" ref="adAggregateAuthHandler" />
</bean>

<bean id="adAuthenticationResponseHandler" 
class="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler" 
/>
<bean id="adAggregateDnResolver" 
class="org.ldaptive.auth.AggregateDnResolver">
       <constructor-arg index="0" ref="adDnResolvers" />
</bean>
<bean id="adAggregateAuthHandler" 
class="org.ldaptive.auth.AggregateDnResolver$AuthenticationHandler"
       p:authenticationHandlers-ref="adAuthHandlers" />
<util:map id="adDnResolvers">
     <entry key="directory1_filter1" value-ref="adDnResolver1" />
     <entry key="directory2_filter3" value-ref="adDnResolver2" />
</util:map>
<!-- define DN resolvers and authentication handlers for each 
directory... -->



We have 2 type of aggregateAuthenticator: 
aggregateAuthenticator(openLDAP) and adAggregateAuthenticator(Active 
Directory)

I need to put these 2 types together in a single 
aggregateAuthenticator_LDAP+AD to be able to use it into my 
ldap.properties to authenticate my users... Did you understand my 
problem now?

How can I do this? Do you know? Do you have an example code that I can 
use to address this specific use case?

Thank you so much Daniel!

Best Regards,
Marco





Il 2016-06-01 15:27 Daniel Fisher ha scritto:
> On Tue, May 31, 2016 at 6:05 PM, Marco Malavolti
> <marco.malavolti at garr.it> wrote:
>
>> Is it impossible for me to use both LDAP and AD to authenticate the 
>> users by configuring simply the ldap-authn-config.xml file?
>
> The example on the wiki[1] is for two directories, so I'm not sure
> what you're confused about. If it's spring beans syntax and XML that
> you're struggling with, I can provide some pointers.
>
> --Daniel Fisher
>
> 
> [1] https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-MultipleDirectories
> [1]
>
>
>
> Links:
> ------
> [1]
> 
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-MultipleDirectories

-- 
Marco Malavolti
  Consortium GARR
  Via dei Tizii, 6 - 00185 Roma
  Mobile: 3488143432
Skype: marco.mala