Searching Active Directory and LDAP Directory

[Dave Perry]

If you control both AD and LDAP - they are both directories.
Is there a reason you have 2? And would it not be better to be looking at Domain Forests? Which could merge the two.

HTH
Dave

_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor’s Walk, York, YO31 7EX
T: +44(0)1904 876 0000
d.perry1 at yorksj.ac.uk<mailto:d.perry1 at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk/>

[cid:f8e2c6fa-d8f6-440a-9631-296584de1575]

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Steven Premeau via users <users at shibboleth.net>
Sent: Wednesday, August 6, 2025 5:07 PM
To: Shib Users <users at shibboleth.net>
Cc: Steven Premeau <steven.premeau at maine.edu>
Subject: Re: Searching Active Directory and LDAP Directory

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.

Alberto -

  Generally, when the question is "Is it possible for Shibboleth to ...?", the answer is yes.  That said, this is a topic where I think you should spend time thinking about whether you SHOULD attempt it.

  The examples that I could find  [1][2] do not seem to fully match what you are seeking.  For example, both assume the directories would be using the same application (and schema), if I am reading your question correctly, you would have two different types of directory.

  Authentication should be the "easy" part, since it would primarily be taking the provided information and attempting to search and/or bind with the directory. Once you are able to get authentication working, you will likely need to tackle how attribute resolution and other parts of your post-authentication process works.

  Testing would be critical... you specifically mention "exists"...

what should happen if (when) there is an overlap in the directories, especially when there's a mismatch in passwords (e.g. authentication fails) or account status (e.g. the account exists in both directories, but is disabled or locked-out in one of them)?

Are both directories providing enough information to accurately manage unique identifiers?

Additionally, if the end goal is to allow account holders in two separately managed and distinctly "scoped" identity stores to authenticate to a single application, the better approach would likely be stand up a separate identity provider for each identity store and leverage discovery (or if the application doesn't support multiple identity providers, a middle-thing) to direct the authentication request to the proper location.

Ultimately, while this is likely technically possible with the Shibboleth IDP, whether you SHOULD or not is a much bigger discussion than the technical implementation and dependent on the details specific to your environment and goals, something that is normally best handled through some form of professional services conversation.

Steve.

[1] - https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration#Chaining-LDAP-validators
[2] - https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Solutions/HOWTO%20Configure%20a%20Shibboleth%20IdP%20v4.x%20to%20authenticate%20users%20existing%20on%20different%20LDAP%20Servers.md  (Note: HOWTO is based on the now unsupported IDP 4)



On Wed, Aug 6, 2025 at 10:52 AM Alberto DeAngelis via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:
Hello,

Would it be possible to do a “Search Active Directory” and then “Search LDAP directory”. So for instance, if a user exists in Active Directory then Shib authentication. If the user doesn’t exist in Active Directory, then it searches LDAP. Is that possible?

Thank you,
Alberto


Alberto DeAngelis '20 '22
Database Administrator
Information Technology Services
[Manhattan University Logo/Shield]
Riverdale, NY 10471
Phone: 718-862-7871
adeangelis01 at manhattan.edu<mailto:adeangelis01 at manhattan.edu>
www.manhattan.edu<http://www.manhattan.edu/>

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
[York St John University is the University of the Year for Social Inclusion in The Times and Sunday Times Good University Guide 2025]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250806/5f65e7ac/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image.png
Type: image/png
Size: 12155 bytes
Desc: image.png
URL: <http://shibboleth.net/pipermail/users/attachments/20250806/5f65e7ac/attachment.png>