<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 8/22/2013 3:17 PM, Brewer, Edward L
wrote:<br>
</div>
<blockquote
cite="mid:986FC1CB53E9F24A8FBD3623AB56559716536B@ITS-HCWNEM105.ds.vanderbilt.edu"
type="cite">
<p class="MsoNormal">I am currently running a 2.3.6 IdP Instance
on JBOSS 5 (RHEL 5) that is configured for UserPassword and
PreviousSession for the login handlers. I have JAAS configured
correctly to use one of our LDAP sources (it is in production
and working correctly). I was just handed a requirement to
integrate with an application that wants to authenticate against
a differing version of LDAP. I read through the section on JAAS
configuration and felt confident I could stack the LDAP servers
in the configuration to allow for auth to either service.
However, this new LDAP that I am adding is a superset of the
current system. More precisely, when we add a new user to our
system we add that user in LDAP1(currently configured) and
LDAP2(want to add). We keep these systems in sync for the user
while they are here. When they leave, we disable the user in
LDAP1 (but leave their entry) and stop updating LDAP2. So the
user is in both but is only able to login to LDAP2. Now, the
concern is that if a user leaves and now is able to login to
LDAP2, they will be able to get access to an application that
assumes they are enabled in LDAP1. I have been given till
tomorrow to dream up a way to ensure that if a user is auth’ed
in LDAP2 that they will not be allowed in any of the current
applications that are configured now. <o:p></o:p></p>
</blockquote>
<o:p><br>
One possibility would be to use two login handlers, one configured
for LDAP1 (default) and one for LDAP2 (selectable with a
particular authentication method you dream up). Then ask the new
app to request that authentication method (or define a separate
RelyingParty for them with that as their default auth method). <br>
<br>
Disclaimer: I don't use the UserPassword/JAAS so I apologize if
there are limitations that prevent this from working...</o:p><br>
<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>