Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[IAM David Bantz]

On Wed, Jun 22, 2016 at 6:06 AM, Daniel Fisher <dfisher at vt.edu> wrote:
>
>
> Only one authentication event occurs. The DN resolver will throw by
> default if more than one DN is found. If you configure it to allow multiple
> DNs, the first one found in the underlying collection will be used.
>
> --Daniel Fisher
>

This is sufficiently counter-intuitive to me that I want to make sure I
understand correctly. If two directory sources are used, and multiple DN
resolvers and authentication handlers defined (per
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-AggregateDNResolver.1),
then if there are in fact DNs found in both directories (the user has
accounts in LDAP and AD) this will cause the aggregate DN resolver to fail,
and hence the user's attempt to authenticate fail.

In other words, with multiple directories (it seems fairly common, for
example, to deploy MS AD and some more generic LDAP directory) the
assumption behind this behavior is that the population of the directories
is disjoint; thus having records with the same username in both directories
is an error condition such that authN cannot succeed for such a user.

99% of our users have records with same username and synchronized passwords
in both MS AD (for Domain use and Windows-centric apps) and Oracle LDAP for
eduPerson and multiple other attributes and self-service updates.  If I've
got the behavior above nearly right, seems we'll have to stick with JAAS
with multiple ldap's each "sufficient" for authN, foregoing features and
efficiency of ldaptive.

David Bantz
UA OIT IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160622/0d10f4bc/attachment-0001.html>