Authentication to two ldap directories

[Ignacio Amoeiro Bosch]

Hello,


At then end I switched to JAAS authentication , using multiple org.ldaptive.jaas.LdapLoginModule with Sufficent.



There is any disadvantage using JAAS over LDAP Authenticator?



Regards




De: users <users-bounces at shibboleth.net> En nombre de Daniel Fisher
Enviado el: lunes, 17 de junio de 2019 22:55
Para: Shib Users <users at shibboleth.net>
Asunto: Re: Authentication to two ldap directories

On Sat, Jun 15, 2019 at 6:01 AM Ignacio Amoeiro Bosch <ignacio.amoeiro at extern.ibsalut.es<mailto:ignacio.amoeiro at extern.ibsalut.es>> wrote:
Hello,

I have configured two ldap directories for authentication following the documentation (https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ExamplefortwoActiveDirectorieswithtwoDNResolversforeach). It  works fine, but when one of the directories is down then it stop authentication although the user i’m triing to authenticate  his LDAP server is up. ¿How I can resolve that? I have read ldaptive documentation, and can’t found how to solve it.

The aggregate DN resolver component that you're using assumes that a failure in any DN resolver should be treated as a failure in the entire DN resolution process. You could configure an active_passive connection strategy and support a third directory that is designed for failover in these circumstances. Although, I'm not sure how you would distinguish an unknown user from a user who does exist but can't be resolved because the directory is currently down. The messaging would be tricky.

Another option would be to use JAAS, which might have the failover characteristics you're looking for.

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190621/1b78dfef/attachment.html>