IdP v3 - Using multiple LDAP schemas

[Bellina, Brendan]

We are working with Unicon currently for development of authentication
flows that allows two distinct login pages - one for the academic campus
and one for the medical campus. We have applications that both populations
will need to access but medical staff will be using credentials issued by
their IdM system and check against their password store. We use 2 login
pages so that it is clear which id should be used and which support path
to take when there are authentication problems. The two password stores
also have different rules for handling repeated incorrect password
attempts. Users are able to toggle between the authentication flows.
Because not all applications should allow all authentication flows, we
maintain attributes in the Relying Party profile that indicate which flows
are available.

Regards,

Brendan Bellina
Identity Mgmt. Architect, IT Services, UCLA
✉ bbellina at ucla.edu   ☏ +1 310 206 3131



On 3/14/16, 12:10 PM, "users on behalf of Michael A Grady"
<users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:

>
>> On Mar 14, 2016, at 10:29 AM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
>> 
>>> What is the best way to accomplish this requirement using IdP v3? Will
>>>we
>>> need to use two separate IdP installations, one for email and another
>>>for TVE
>>> users?
>> 
>> Even if you duplicated the Password flow, the flow definition uses the
>>view name "login" to render the page, so there would be no way to
>>separate it into a separate page, even if the back-end were configured
>>differently. So you would have to basically copy and adapt the Password
>>flow and adjust the flow definition slightly at this point. That should
>>be corrected I think to make that more configurable, but there's no
>>avoiding creating a second copy of the flow regardless, it's just not
>>really designed to support that use case easily.
>> 
>
>Assuming you want to continue to have two distinct Login pages, then the
>following won't help you. But we had a client that needed the option of
>switching between two distinct authentication sources, and just needed a
>"toggle", on the Login page itself, as to which source was being used. So
>we have an extension for the IdP called SplitAuthn that you can find here:
>
>  https://github.com/Unicon/ccc-shib-split-authn
>
>When time permits, we'll more formally write that up as a contribution.
>
>p.s. There were several reasons around how identifiers are assigned and
>managed, and folks potentially having an account in both, which made just
>"chaining the sources" (which you can do "out of the box", although
>somewhat painfully if you stick with the new LDAP config) not a good fit.
>
>--
>Michael A. Grady
>IAM Architect, Unicon, Inc.
>