Authentication to two ldap directories

[Daniel Fisher]

On Sat, Jun 15, 2019 at 6:01 AM Ignacio Amoeiro Bosch <
ignacio.amoeiro at extern.ibsalut.es> wrote:

> Hello,
>
>
>
> I have configured two ldap directories for authentication following the
> documentation (
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ExamplefortwoActiveDirectorieswithtwoDNResolversforeach).
> It  works fine, but when one of the directories is down then it stop
> authentication although the user i’m triing to authenticate  his LDAP
> server is up. ¿How I can resolve that? I have read ldaptive documentation,
> and can’t found how to solve it.
>

The aggregate DN resolver component that you're using assumes that a
failure in any DN resolver should be treated as a failure in the entire DN
resolution process. You could configure an active_passive connection
strategy and support a third directory that is designed for failover in
these circumstances. Although, I'm not sure how you would distinguish an
unknown user from a user who does exist but can't be resolved because the
directory is currently down. The messaging would be tricky.

Another option would be to use JAAS, which might have the failover
characteristics you're looking for.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190617/aac3d733/attachment.html>