<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 21, 2019, at 5:28 PM, Peter Schober <<a href="mailto:peter.schober@univie.ac.at" class="">peter.schober@univie.ac.at</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">* Myn Harry <<a href="mailto:mynharry@gmail.com" class="">mynharry@gmail.com</a>> [2019-05-21 21:47]:<br class=""><blockquote type="cite" class="">Is there a way in Shibboleth to bind against both Active Directories for<br class="">authentications? Try College A, and next College B, for successful bind?<br class=""></blockquote><br class="">Note that unless you know that userids/netids (whatever subjects enter<br class="">during authen on your IDPs login page) are unique across both<br class="">directories that's potentially insecure.<br class=""><br class="">(Only) If subjects are already forced to enter domain-qualified<br class="">userids (e.g. <a href="mailto:user@example.org" class="">user@example.org</a>) during login would that be safe.<br class=""><br class="">-peter<br class=""><br class=""></div></div></blockquote><br class=""></div><div>Yes, if your namespaces are going to overlap, such that the username the users fill in is not unique between the 2 directories, another alternative to consider is to use the Unicon SplitAuthn extension, but then the user needs to choose which they want to use on the Login page. Or some similar approach. See:</div><div><br class=""></div><div> <a href="https://github.com/Unicon/ccc-shib-split-authn" class="">https://github.com/Unicon/ccc-shib-split-authn</a></div><div><br class=""></div><div>That approach allows for tying the attribute source to the authentication source, so only one directory is accessed for both, based on the "realm" chosen by the user.</div><div><br class=""></div><div>Or, as Peter suggests, make them enter domain-qualified userids as the username in the first place.</div><div><br class=""></div><div>p.s. It is now being used with 3.4.x releases, so it will work with 3.4.x, need to get that page updated.</div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>