IdP v3 - Using multiple LDAP schemas

[Michael A Grady]

> On Mar 14, 2016, at 10:29 AM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> What is the best way to accomplish this requirement using IdP v3? Will we
>> need to use two separate IdP installations, one for email and another for TVE
>> users?
> 
> Even if you duplicated the Password flow, the flow definition uses the view name "login" to render the page, so there would be no way to separate it into a separate page, even if the back-end were configured differently. So you would have to basically copy and adapt the Password flow and adjust the flow definition slightly at this point. That should be corrected I think to make that more configurable, but there's no avoiding creating a second copy of the flow regardless, it's just not really designed to support that use case easily.
> 

Assuming you want to continue to have two distinct Login pages, then the following won't help you. But we had a client that needed the option of switching between two distinct authentication sources, and just needed a  "toggle", on the Login page itself, as to which source was being used. So we have an extension for the IdP called SplitAuthn that you can find here:

  https://github.com/Unicon/ccc-shib-split-authn

When time permits, we'll more formally write that up as a contribution.

p.s. There were several reasons around how identifiers are assigned and managed, and folks potentially having an account in both, which made just "chaining the sources" (which you can do "out of the box", although somewhat painfully if you stick with the new LDAP config) not a good fit.

--
Michael A. Grady
IAM Architect, Unicon, Inc.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://shibboleth.net/pipermail/users/attachments/20160314/f892559f/attachment.sig>