active directory data connection

[Nate Klingenstein]

Steve,

> So if in my ldap.properties file, can I do something like this to distinguish the difference between the different configurations?

Yes, you can.  You can define arbitrary Spring properties just as you have below, and you used sensible nomenclature to do it.

> idp.authn.ADLDAP.ldapURL                     = ldaps://ActiveDirectoryServer:636
> idp.authn.LDAP.ldapURL                          = ldaps://OpenLdapServer:636

You can do the same thing for the userFilter that you did for the ldapURL.  But note that this is the authentication user filter, and maybe not what you want.   Consider instead:

idp.attribute.resolver.ADLDAP.searchFilter   = (sAMAccountName=$resolutionContext.principal)
idp.attribute.resolver.LDAP.searchFilter        = (uid=$resolutionContext.principal)

And set the authn userFilter to the proper value for whichever directory you're authenticating the user against.  If you're attempting to authenticate users against both, blessings unto thee, and I'd look carefully at my overall architecture.  It's not as simple as pulling attributes from both, though it is doable.

> I'd like to add these additional properties but I don't know how to reference them since they have the same name.

Just make sure the property names are different.  If the IdP has the same property name defined twice, it will use the first value it encountered and ignore the second declaration.

LDAP Data Connector:

        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.LDAP.searchFilter}
            ]]>
        </FilterTemplate>

AD Data Connector:

        <FilterTemplate>
            <![CDATA[
                %{idp.attribute.resolver.ADLDAP.searchFilter}
            ]]>
        </FilterTemplate>

Take care,
Nate.

--------

Signet, Inc.
The Art of Access ®

https://www.signet.id