Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[Michael A Grady]

>> 
>> So, given one configures to allow multiple DNs, the first one found in the collection will then determine which LDAP instance the BIND attempt as the user will be done with, correct?
>> 
> 
> And, more to the point, if you want the SUFFICIENT behavior of JAAS, you need to use JAAS, you can't easily get it to try the second DN in the collection if the first one chosen "fails"?
> 

So one "on the surface" advantage of using the LDAP config versus the JAAS config with v3 is the more obvious documented support for handling LDAP error codes/expiring passwords etc. with the LDAP config. But looking back, I see that even with v2 one could add:

 authenticationControls="org.ldaptive.control.PasswordPolicyControl"

to the JAAS config (if one included the Ldaptive jar). So is using the exact same password policy support in v3 with JAAS as simple as adding that above line if it is OpenLDAP, and as simple as adding something like:

 authenticationControls="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler"

if an AD source? Or does the latter only work if using the Ldaptive ldap-authn?

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160622/e27947c7/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160622/e27947c7/attachment.sig>