Searching Active Directory and LDAP Directory

[Steven Premeau]

Alberto -

  Generally, when the question is "Is it possible for Shibboleth to ...?",
the answer is yes.  That said, this is a topic where I think you should
spend time thinking about whether you SHOULD attempt it.

  The examples that I could find  [1][2] do not seem to fully match what
you are seeking.  For example, both assume the directories would be using
the same application (and schema), if I am reading your question correctly,
you would have two different types of directory.

  Authentication should be the "easy" part, since it would primarily be
taking the provided information and attempting to search and/or bind with
the directory. Once you are able to get authentication working, you will
likely need to tackle how attribute resolution and other parts of your
post-authentication process works.

  Testing would be critical... you specifically mention "exists"...

what should happen if (when) there is an overlap in the directories,
especially when there's a mismatch in passwords (e.g. authentication fails)
or account status (e.g. the account exists in both directories, but is
disabled or locked-out in one of them)?

Are both directories providing enough information to accurately manage
unique identifiers?

Additionally, if the end goal is to allow account holders in two
separately managed and distinctly "scoped" identity stores to authenticate
to a single application, the better approach would likely be stand up a
separate identity provider for each identity store and leverage discovery
(or if the application doesn't support multiple identity providers, a
middle-thing) to direct the authentication request to the proper location.

Ultimately, while this is likely technically possible with the Shibboleth
IDP, whether you SHOULD or not is a much bigger discussion than the
technical implementation and dependent on the details specific to your
environment and goals, something that is normally best handled through some
form of professional services conversation.

Steve.

[1] -
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration#Chaining-LDAP-validators
[2] -
https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Solutions/HOWTO%20Configure%20a%20Shibboleth%20IdP%20v4.x%20to%20authenticate%20users%20existing%20on%20different%20LDAP%20Servers.md
(Note: HOWTO is based on the now unsupported IDP 4)



On Wed, Aug 6, 2025 at 10:52 AM Alberto DeAngelis via users <
users at shibboleth.net> wrote:

> Hello,
>
> Would it be possible to do a “Search Active Directory” and then “Search
> LDAP directory”. So for instance, if a user exists in Active Directory then
> Shib authentication. If the user doesn’t exist in Active Directory, then it
> searches LDAP. Is that possible?
>
> Thank you,
> Alberto
>
>
> Alberto DeAngelis '20 '22
>
> *Database Administrator Information Technology Services*
> [image: Manhattan University Logo/Shield]
> Riverdale, NY 10471
> Phone: 718-862-7871
> *adeangelis01 at manhattan.edu <adeangelis01 at manhattan.edu>*
> *www.manhattan.edu <http://www.manhattan.edu/>*
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250806/817dfdc4/attachment.htm>