<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><font face="Lucida Sans">Our IdP uses multiple LDAP directories for redundancy and harvesting attributes that are in one but not other sources.</font><div><font face="Lucida Sans">That is, the IdP authenticates users against multiple directories and regards the user as authenticated as long as one bind attempt succeeds. </font></div><div><font face="Lucida Sans">I have verified that even if authentication fails against one of those sources, the attributes for that identity are available, and that has met our needs up to now. (That is, the IdP retrieves, say, specific entitlements and campus affiliation from one source, and group memberships from another. And I get both sets of attributes even if authentication fails in one of those sources.) </font></div><div><font face="Lucida Sans"><br></font></div><div><font face="Lucida Sans">I am now looking at a new need, in which users will have records in 1, 2, or 3 directories. The username will be the same, but the passwords generally different. In this new scenario, though, we expect a key single-valued attribute to have a different value in each instance. </font></div><div><font face="Lucida Sans"><br></font></div><div><font face="Lucida Sans">What happens if two different LDAP sources return different values of a single-valued attribute? Are they distinguishable within the attribute-resolver processing if I just specify different attribute resolver dependencies:</font></div><div><font face="Lucida Sans"><br></font></div><div><div style="margin: 0px; font-size: 13px; "><div style="margin: 0px; "><font color="#0056d6" face="Lucida Sans"> <resolver:AttributeDefinition id="employeeNumber1" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"</font></div><div style="margin: 0px; "><font color="#0056d6" face="Lucida Sans"> sourceAttributeID="employeeNumber"></font></div><div style="margin: 0px; "><font color="#0056d6" face="Lucida Sans"> <resolver:Dependency ref="LDAP1" />...</font></div><div><font color="#0056d6" face="Lucida Sans"><br></font></div><div><div style="margin: 0px; "><font color="#0056d6" face="Lucida Sans"> <resolver:AttributeDefinition id="employeeNumber2" xsi:type="Simple" xmlns="urn:mace:shibboleth:2.0:resolver:ad"</font></div><div style="margin: 0px; "><font color="#0056d6" face="Lucida Sans"> sourceAttributeID="employeeNumber"></font></div><div style="margin: 0px; "><font color="#0056d6" face="Lucida Sans"> <resolver:Dependency ref="LDAP2" />...</font></div></div><div style="color: rgb(255, 147, 0); "><font face="Lucida Sans"><br></font></div><div><font face="Lucida Sans">so that I might pass 2 differently labeled SAML attributes?</font></div><div><font face="Lucida Sans"><br></font></div><div><font face="Lucida Sans">What would be more useful would be to resolve values from ONLY the LDAP directory source(s) which successfully authenticated the user. Is that something that could be readily configured or scripted in the IdP?</font></div><div><font face="Lucida Sans"><br></font></div><div>David Bantz</div></div></div></body></html>