<HTML><BODY><p>In my test environment I need emulate work of two IdPs. SP will have a page where user will select the IdP to login with.<br data-mce-bogus="1"></p><p>I don't want to have two installations of shibboleth so I would like to build the following:<br></p><p>One IdP will be available by two URLs like <a href="http://institute1.org/shib/">http://institute1.org/shib/</a> <a href="http://institute2.org/shib">http://institute2.org/shib</a></p><p>SP will redirect user to one or another URL passing different values of Issuer field.<br data-mce-bogus="1"></p><p>IdP will have two SPs configured and will act differently depending on what SP entity Id it got in SAML request.</p><p>I see no issues here.</p><p>IdP is connected to ApacheDS. ApacheDS has users for both institutes. Users sits in different OU (organisation unit)<br data-mce-bogus="1"></p><p>So I need a wat to choose LDAP options for authentication depending on SP name.<br data-mce-bogus="1"></p><p>I have: </p><p>idp.authn.LDAP.dnFormatOrg1= uid=%s, OU=org1_Users<br data-mce-bogus="1"></p><p> idp.authn.LDAP.dnFormatOrg2= uid=%s, OU=org2_Users <br data-mce-bogus="1"></p><p>I am looking at activation conditions:<br data-mce-bogus="1"></p><p><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions">https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions</a><br data-mce-bogus="1"></p><p><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAttributePluginActivationConditions">https://wiki.shibboleth.net/confluence/display/IDP30/ExternalAttributePluginActivationConditions</a><br data-mce-bogus="1"></p><p>I see they can be applied to Data Connectors but I don't know how to use it in ldap-authn-config.xml<br data-mce-bogus="1"></p><p>I expected to add two conditions and use them to choose formatDnResolver bean.<br data-mce-bogus="1"></p><p><!-- Format DN resolution --><br> <bean id="formatDnResolver" class="org.ldaptive.auth.FormatDnResolver" p:format="%{idp.authn.LDAP.dnFormatOrg1:undefined}" p:activationConditionRef="org1SPCondition" /><br data-mce-bogus="1"></p><p> <bean id="formatDnResolver" class="org.ldaptive.auth.FormatDnResolver" p:format="%{idp.authn.LDAP.dnFormatOrg2:undefined}" p:activationConditionRef="org2SPCondition" /> </p><p><!-- Single SP --><br><bean id="MyCondition" parent="shibboleth.Conditions.RelyingPartyId"<br> c:_0="#{{'https://institute1.org/shib'}}" /></p><p>This bean seems not hav activationConditionRef attribute. It looks like it is shibboleth feature that is not possible in ldaptive's sections.</p><p>So the question is Could I have different LDAP parameters for authentication for different SPs?<br data-mce-bogus="1"></p><p><br>Robo Burned</p></BODY></HTML>