Different baseDN for LDAP authentication per entityID

[Peter Schober]

* stoneforger <ext.vasileios.kalampakas at tieto.com> [2017-02-03 15:42]:
> Now, in the LDAP we want to authenticate against different dc's per entity:
> 
> So entityID A needs to authenticate against dc=A,dc=site,dc=com .
> entityID B needs to authenticate against dc=B,dc=site,dc=com .
> entityID C needs to authenticate against dc=C,dc=site,dc=com .
> 
> Now, users across these dc's will share usernames, and uid's might clash (
> according to how the schema/LDAP is used/designed currently and it doesnt
> look it will change).

How are you authenticating subjects with any other LDAP client given
that scenario? Are they supposed to enter their full DN during
authentication? ;)

> So a person might have an account in all these dc's, but what he is
> authenticating against each time depends on which SP he is using to login.

A given uid will represent the same person in whatever part of the DIT
it will be found? But objects with identical uid values (but in
different parts of the DIT) might have differing passwords?
Sounds like a self-inflicted support nightmare to me.

I'm pretty sure the Shib IDP can even be bent to do just what you
want, but I've no idea how. (I'm not managing to keep up with features
and spring and beans and stuff.)
-peter