Shibboleth IdP v3.2.1 & LDAP+AD Authentication

[Daniel Fisher]

On Wed, Jun 22, 2016 at 3:28 PM, Michael A Grady <mgrady at unicon.net> wrote:

> So one "on the surface" advantage of using the LDAP config versus the JAAS
> config with v3 is the more obvious documented support for handling LDAP
> error codes/expiring passwords etc. with the LDAP config. But looking back,
> I see that even with v2 one could add:
>
>  authenticationControls="org.ldaptive.control.PasswordPolicyControl"
>
> to the JAAS config (if one included the Ldaptive jar). So is using the
> exact same password policy support in v3 with JAAS as simple as adding that
> above line if it is OpenLDAP, and as simple as adding something like:
>
>  authenticationControls="
> org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler"
>
> if an AD source? Or does the latter only work if using the Ldaptive
> ldap-authn?
>

I didn't implement the v3 LDAP support with an eye towards parity with the
JAAS module.
That said, I feel fairly confident that either config will support the same
functional behavior. (There may be some corner cases I'm forgetting...)
The issue revolves around limitations in the JAAS config syntax and the
stateless nature of JAAS.
But, if you're properly motivated, I believe it can be done. (There is even
support of configuring JAAS with Spring beans...)

However, I would spend my time getting the v3 config working rather than an
exotic JAAS config, unless JAAS is the only option.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160623/0be89d9f/attachment.html>