<div dir="ltr">OK, let me clarify the use case.<div><br></div><div>1) Authenticate against database</div><div>2) If no user there, try to authenticate against LDAP</div><div>3) if succeeded, then fetch the attribute from the data source where the user authenticated.</div>
<div><br></div><div>After investigating Shibboleth and the common practices (and other products), I think that would be the appropriate approach, since the IdP could be the common place where all the data aggregations would happen.</div>
<div><br></div><div>Each SP can be configured to use only one IdP, so the method of using different user/attrib stores would be up to the Shibboleth.</div><div><br></div><div>Maybe I'm wrong, but then please advise different way.</div>
<div><br></div><div>Cheers,</div><div><br></div><div>Tamas</div></div><div class="gmail_extra"><br clear="all"><div>VWOL<br>Tamas SZERB <<a href="mailto:toma@rulez.org">toma@rulez.org</a>></div>
<br><br><div class="gmail_quote">On Tue, Jun 24, 2014 at 10:32 AM, Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
* Peter Schober <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> [2014-06-24 10:18]:<br>
<div class="">> So you want to use both JDBC and LDAP in both the JAAS modules as well<br>
> as the IDP's data connectors in the attribute resolver /and/ the same<br>
> identifier in those systems refer to different people? Not a good idea.<br>
<br>
</div>Going even further, if you have identical identifers in the RDBMS and<br>
in LDAP and they refer to different subjects (persons), then you<br>
cannot have both JDBC and LDAP JAAS modules active at the same time.<br>
<br>
The IDP would need to iterate over all JAAS modules (i.e., submit the<br>
credentials supplied to the IDP to each module until one succeeded)<br>
and the only thing preventing subject A (with identifer "foo" in the<br>
RDBMS) from logging in as subject B (with identifer "foo" in LDAP)<br>
would be the password. So you'd need to enforce that the passwords<br>
for those two subjects using the same identifier cannot be identical,<br>
otherwise both subjects would end up using the account from the system<br>
defined first in the JAAS module stack (i.e., someone would<br>
authenticate corretly and be represented as a different person).<br>
<br>
And if you could prevent passwords in the RDBMS from being identical<br>
from passwords in LDAP (for the same identifier) you could also have<br>
prevented identical identifiers in those systems from being assigned<br>
to different subjects in the first place.<br>
<br>
So this is not about attriute resolution in the IDP at all, IMO, you<br>
can't even perform authentication properly that way.<br>
<div class="HOEnZb"><div class="h5">-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>