So as a bit of background we are consolidating several user data stores behind one IdP. We are using a Tomcat CombinedRealm to do "fall-through" authentication and populating roles based on the the realm the user authenticates against. For JNDI (LDAP) realms we are using the commonRole attribute to hard code this value. Here is an example:<br>
<br> <Realm className="org.apache.catalina.realm.CombinedRealm" ><br><br> <!-- Check Directory A--><br> <Realm className="org.apache.catalina.realm.JNDIRealm"<br> connectionURL="ldaps://<a href="http://a.example.edu:636">a.example.edu:636</a>"<br>
userPattern="uid={0},ou=a,dc=example,dc=edu"<br> userRoleName="eduPersonAffiliation"<br> commonRole="directoryA" /><br><br> <!-- Check Directory B--><br>
<Realm className="org.apache.catalina.realm.JNDIRealm"<br> connectionURL="ldaps://<a href="http://b.example.edu:636">b.example.edu:636</a>"<br> userPattern="uid={0},ou=b,dc=example,dc=edu"<br>
userRoleName="eduPersonAffiliation"<br> commonRole="directoryB" /><br><br> <!-- Check Database C, users in this database will have a role of 'directoryC'--><br>
<Realm className="org.apache.catalina.realm.JDBCRealm"<br> connectionName="username"<br> connectionPassword="password"<br> connectionURL="jdbc:mysql://localhost:3306/directoryc_users"<br>
driverName="com.mysql.jdbc.Driver"<br> userTable="users" userNameCol="user_name" userCredCol="user_pass"<br> userRoleTable="user_roles" roleNameCol="role_name"/><br>
<br> </Realm><br><br>Unfortunately there is no guarantee the usernames will be unique across all of the data stores. Would a better approach in this situation be to create unique usernames via an external auth handler? Basically I'm thinking of concatenating the username with the realm identifier: user@directoryA?<br>
<br>Thanks for the feedback,<br><br>--Nathan<br><br><div class="gmail_quote">On Wed, Dec 5, 2012 at 10:12 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="im">On 12/5/12 9:46 AM, "Nathan Mische" <<a href="mailto:nmische@gmail.com">nmische@gmail.com</a>> wrote:<br>
><br>
>We currently have a Shibboleth 2.5 IdP instance running on Tomcat 6 using<br>
>container based authentication and the remote user login handler. We<br>
>would like to expose the Tomcat principal's roles as attributes, is this<br>
>possible?<br>
<br>
</div>Probably, but I wouldn't do that. Whatever you're using to populate the<br>
roles you should simply expose directly from the data source to the<br>
resolver. Leave the authentication step to produce a clear and simple<br>
username and that's all.<br>
<span class="HOEnZb"><font color="#888888"><br>
-- Scott<br>
</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br>