IdP 4.0.1 and ldap/UnboundID connectionStrategy

[Jarno Huuskonen]

Hello,

On Tue, 2021-02-02 at 14:55 +0000, Cantor, Scott wrote:
> On 2/2/21, 9:41 AM, "users on behalf of Jarno Huuskonen"
> <users-bounces at shibboleth.net on behalf of jarno.huuskonen at uef.fi> wrote:
> >    Does anybody have an example for creating multiple LDAPValidator
> > beans ?
> 
> The documentation describes and provides an example of how to override the
> ldaptive Authenticator for a particular validator.
> 
> That in turn is configurable in just about every way by creating beans
> inheriting from shibboleth.LDAPAuthenticationFactory of type
> LDAPAuthenticationFactoryBean, the javadoc for which is linked from the
> Beans reference on the LDAPAuthnConfiguration page.
> 
> Among the properties is the LDAP server URL. i.e. define a bunch of
> separate beans with their own URLs and plug each one into a different
> LDAPValidator.

I think I managed to get a working config, here's short description. Maybe
it'll help others.

authn/ldap-authn-config.xml:
+    <bean id="shibboleth.authn.LDAP.authenticator2"
parent="shibboleth.LDAPAuthenticationFactory" lazy-init="true"
p:ldapUrl="%{idp.authn.LDAP.ldapURL2}" />

authn/password-authn-config.xml:
     <!-- Ordered list of CredentialValidators to apply to a request. -->
     <util:list id="shibboleth.authn.Password.Validators">
-        <ref bean="shibboleth.LDAPValidator" />
+        <bean parent="shibboleth.LDAPValidator" p:authenticator-
ref="shibboleth.authn.LDAP.authenticator" />
+        <bean parent="shibboleth.LDAPValidator" p:authenticator-
ref="shibboleth.authn.LDAP.authenticator2" />
     </util:list>

(and in ldap.properties idp.authn.LDAP.ldapURL with one server and
idp.authn.LDAP.ldapURL2 with another).

Thanks Scott for pointing me in the right direction.

-Jarno

-- 
Jarno Huuskonen