Multiple LDAPs and Research Services

[Cantor, Scott]

> The one unknown is how this configuration would behave for non-research
> service authentication. Only RCI apps should auth against the RCI LDAP.

You can attach activation conditions to the credential validators in the chain when you configure more than one, so that's one way of managing it, but obviously you can't do anything without defined business logic for making the decision and exposing it. Metadata tagging is generally the best way to expose it.

> If you've encountered a similar use case, what solution did you implement?

I started out in 2004 by making it clear to all consumers of my service that absolutely any sentient being in the universe could authenticate to our IdP. Any other assumptions made about that were in error and would not be tolerated or accomodated.

So my solution was just to refuse to ever allow conditional authentication because that's buck passing. Not my job to authorize the planet. I will do it in specific cases for SAAS apps that are braindead, but not as a general hammer.

-- Scott