Different baseDN for LDAP authentication per entityID

[stoneforger]

Hello,

maybe this isn't the correct approach - but - here's a short description of
the problem:

We have three different service providers authenticating against the same
IdP.

The IdP is authenticating against an LDAP.

Now, in the LDAP we want to authenticate against different dc's per entity:

So entityID A needs to authenticate against dc=A,dc=site,dc=com .
entityID B needs to authenticate against dc=B,dc=site,dc=com .
entityID C needs to authenticate against dc=C,dc=site,dc=com .

Now, users across these dc's will share usernames, and uid's might clash (
according to how the schema/LDAP is used/designed currently and it doesnt
look it will change).

So a person might have an account in all these dc's, but what he is
authenticating against each time depends on which SP he is using to login.

Will setting up a userfilter to include OR in these dc's and the UID work ?
Like :
(&(|(ou:dn:=users,ou:dn:=groupC,dc:dn:=organizationC)(ou:dn:=users,ou:dn:=groupB,dc:dn:=organizationB)(ou:dn:=users,ou:dn:=organizationA)(uid={user}))

( per extensible matching in
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration
)

or would I need to configure separate login flows, and attach conditions as
referred to here:

http://shibboleth.net/pipermail/users/2015-November/025555.html

Point in case, the particular solution doesn't matter as long the clashes
are avoided and the user logins to the correct organization with the
relevant attributed returned.

I can't find any guides about this kind of setup and the documentation
although extensive is a bit convoluted and there are only few examples.

Sorry for any wrong nomenclature and appreciate any help.




--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Different-baseDN-for-LDAP-authentication-per-entityID-tp7631169.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.