How to use multiple ldapURLs and baseDNs?

[Lucia Siochi]

Thanks for pointing me in that direction. We have more than one directory to search as well, but I did find these examples, which I am currently trying out:

https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ExamplefortwoActiveDirectorieswithtwoDNResolversforeach

* Lucia Siochi <Lucia.Siochi at cpcc.edu> [2016-03-14 23:52]:
> Our students and employees are in separate AD trees (not sure if
> that's the correct terminology). Basically, the idp.authn.LDAP.ldapURL
> for employees is different than the ldapURL for students.
>
> Also, within the AD "tree" for employees, there are multiple
> idp.authn.LDAP.baseDNs for authentication to check.

Personally I'd set the search base to something from where it will find both employees and students (e.g. the actual baseDN of the LDAP server, or the most specific part of the tree they share) and set idp.authn.LDAP.subtreeSearch to true.

Whether or not that works may depend on your MS-AD deployment (no idea, never had to use it) from looking at this -- never mind the IDP version that page is for as it about MS-AD:
https://wiki.shibboleth.net/confluence/display/SHIB2/LdapServerIssues#LdapServerIssues-MicrosoftActiveDirectory
But for authentication (not attribute resolving) talking to the global catalog port should probably work?

> I need to be able to check all these locations for authentication.
> Does anyone else have this situation? I saw a post that was similar,
> but it was for IdPv2.  I am using IdPv3.

Here's v3 using the internal LDAP authn:
("Extensible Matching" or "Aggregate DN Resolver") https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-SingleDirectorywithmultiplebranches

I don't see a need but you could also switch to JAAS https://wiki.shibboleth.net/confluence/display/IDP30/JAASAuthnConfiguration
and then stack two modules as in IDPv2, cf. "Stacking Login Modules" on https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthUserPass

Both the IDPv3 and the v2 docs have examples for exactly your use case of searching the same directory twice, starting from different search bases.
-peter


This e-mail, including any attachments, is intended only for the addressee's use and may contain confidential and proprietary information. If you are not the intended recipient, you are hereby notified that any retention, dissemination, reproduction, or use of the information contained in this e-mail is strictly prohibited. If you have received this e-mail by error, please delete it and immediately notify the sender. Thank you for your cooperation.