Multiple authentication domains mapping to different user repositories

[Florin Stingaciu]

Hello all,

I have searched up and down for information regarding the following use
case with no success. Basically I have to ldap servers, call them ldap-1
and ldap-2. And I use shibboleth as my IDP. I basically want the following:

   - user florin reaches the SP who will get redirected to the IDP for auth
   - at the IDP, the user will use florin at domain-1 to login which follows
   the username@<auth_domain> format
   - using "@domain-1" will cause the IDP to try auth the user "florin" to
   ldap-1 and
*ldap-1 only *
   - upon successful auth, the attributes that should be passed back to the
   SP are defined for each authentication domain, meaning that the IDP will
   collect different attributes from ldap-1 and ldap-2 respectively

I have found multiple sources of documentation with regards to using
multiple LDAP servers which basically state that the IDP will try to bind
with all of them until it succeeds with one (to be honest the actual
behavior is not explicitly described in the documentation, except for maybe
a warning to not have conflicting user IDs across multiple identity
backends). I have also found documentation on how to use a different ldap
server based on the SP that initiates the authentication process. However I
come up empty handed for this use case.

I have worked in the past with some proprietary IDPs that support this
feature out of the box. Maybe I've been spoiled. Any help or direction in
trying to solve for this use case would be highly appreciated. If the
shibboleth IDP doesn't support this, can anyone recommend an open-source
IDP that does? I've already tried FreeIPA and Gluu and neither of them
support this.

Thanks,
-F
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170426/ac4b4786/attachment.html>