<div dir="ltr">







<p class=""><span class="">Something like this in a jaas.config (multiple directories each with both OUs)</span></p><p class=""><span class="">  // first OU</span></p>
<p class=""><span class="">  org.ldaptive.jaas.LdapLoginModule sufficient</span></p>
<p class=""><span class="">   </span> ldapUrl="ldap://ldap1.tld:3268 ldap://ldap2:3268"</p><p class="">    baseDn="ou=OU1,dc=ldap,dc=tld"</p>
<p class=""><span class="">    bindDn="cn=..."</span></p>
<p class=""><span class="">    bindCredential="••••••••••••••••••••"</span></p><p class=""><span class=""></span></p><p class=""><span class="">    sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/...}"</span></p>
<p class=""><span class="">    ssl="false"</span></p>
<p class=""><span class="">    tls="true"</span></p>
<p class=""><span class="">    </span>  userFilter="(|(sAMAccountName={user})(employeeNumber={user}))"</p>
<p class=""><span class="">    ;</span></p>
<p class=""><span class=""></span><br></p>
<p class=""><span class="">  // second OU</span></p>
<p class=""><span class="">  org.ldaptive.jaas.LdapLoginModule sufficient</span></p>
<p class=""><span class="">    ldapUrl="ldap://ldap1.tld:3268 ldap://ldap2:3268"</span></p>
<p class="">    baseDn="ou=OU2,dc=ldap,dc=tld"</p><p class="">    bindDn="cn=..."<br></p>
<p class=""><span class="">    bindCredential="••••••••••••••••••••••••"</span></p>
<p class=""><span class="">    sslSocketFactory="{trustCertificates=file:/opt/shibboleth-idp/trustedservercerts/...}"</span></p>
<p class=""><span class="">    ssl="false"</span></p>
<p class=""><span class="">    tls="true"</span></p>
<p class=""><span class="">    userFilter="(|(sAMAccountName={user})(employeeNumber={user}))"</span></p>
<p class=""><span class="">    ;</span></p></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Aug 17, 2016 at 9:11 AM, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 8/17/16 1:05 PM, Juan Quintanilla wrote:<br>
><br>
> So If we setup multiple authentication handlers on Shibboleth, is there<br>
> a way to tell it to stop processing the other authentication handlers<br>
> once a match is found?<br>
<br>
</span>There are no authentication handlers in Shibboleth, unless you mean<br>
something internal to the LDAP flow, which I can't answer.<br>
<br>
If you mean login flows, it can't work like that when there's user input<br>
involved, so I doubt that's what you're referring to.<br>
<br>
David's JAAS suggestion is valid, since JAAS would cascade attempts<br>
within a configuration, and the IdP can cascade attempts to try<br>
different JAAS configurations also. All of that assumes JAAS, and not<br>
native LDAP.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</div></div></blockquote></div><br></div>