Kyle,<div>have a look at adding an authorization handler to the jaas config: <a href="https://code.google.com/p/vt-middleware/wiki/vtldapAuthentication" target="_blank">https://code.google.com/p/vt-middleware/wiki/vtldapAuthentication</a></div>
<div>Once you've coded one, it can be added like this:</div><div><br></div><div><div> edu.vt.middleware.ldap.jaas.LdapLoginModule required</div><div> ldapUrl="..."</div><div> ...</div><div> authorizationHandlers="edu.utexas.austin.CustomAuthorizationHandler"</div>
<div> ...</div><div> };</div><div><br></div><div>--Daniel Fisher</div><br><div class="gmail_quote">On Thu, Feb 28, 2013 at 2:33 PM, Royder, Kyle D <span dir="ltr"><<a href="mailto:kroyder@austin.utexas.edu" target="_blank">kroyder@austin.utexas.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Thanks for the help Scott. This put me on a different search path of the users list and there seem to be a lot of discussion surrounding using a search filter vs implementing something in LDAP itself. Looks like I have a few options moving forward.<br>
<span><font color="#888888"><br>
-Kyle<br>
</font></span><div><div><br>
-----Original Message-----<br>
From: <a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> [mailto:<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>] On Behalf Of Cantor, Scott<br>
Sent: Thursday, February 28, 2013 12:19 PM<br>
To: Shib Users<br>
Subject: Re: Custom Login Handlers? LDAP Authentication<br>
<br>
On 2/28/13 1:03 PM, "Royder, Kyle D" <<a href="mailto:kroyder@austin.utexas.edu" target="_blank">kroyder@austin.utexas.edu</a>> wrote:<br>
<br>
>We use LDAP for authentication and attribute queries. We are wanting<br>
>throw authentication errors if certain LDAP attributes are set certain<br>
>ways and now allow the user to create an IdP session.<br>
<br>
Well, normally I think you do that with LDAP by adjusting the search<br>
filter that looks up the DN for binding. If you can't express it in a<br>
simple search filter, there may be additional plug points in the vt-ldap<br>
(now ladaptive) code that would let you do this by developing the<br>
extension there rather than having to do a custom login handler.<br>
<br>
The author's on the list, he would know and can comment.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>