<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
If you control both AD and LDAP - they are both directories.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Is there a reason you have 2? And would it not be better to be looking at Domain Forests? Which could merge the two.</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
HTH</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Dave</div>
<div class="elementToProof" id="Signature">
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);" class="elementToProof">
_________________________________________________</div>
<table style="box-sizing: border-box; border-collapse: collapse; border-spacing: 0px;">
<tbody>
<tr>
<td style="padding: 0cm 5.4pt; vertical-align: top; width: 303.75pt; height: 96.45pt;">
<p style="line-height: 120%; margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;" class="elementToProof">
<span style="font-family: Arial, sans-serif; font-size: 10pt;"><b>Dave Perry</b></span><span style="font-family: "Times New Roman", serif; font-size: 12pt;"><br>
</span><span style="font-family: Arial, sans-serif; font-size: 9pt;">Application Analyst
<b>| </b>Innovation & Technology Services<br>
<br>
York St John University </span></p>
<p style="line-height: 120%; margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;" class="elementToProof">
<span style="font-family: Arial, sans-serif; font-size: 9pt;">Lord Mayor’s Walk, York, YO31 7EX<br>
T: +44(0)1904 876 0000<br>
</span><a style="margin-top: 0px; margin-bottom: 0px;" title="mailto:d.perry1@yorksj.ac.uk" href="mailto:d.perry1@yorksj.ac.uk">d.perry1@yorksj.ac.uk</a><span style="font-family: Arial, sans-serif; font-size: 9pt;">
<b>| </b><a style="margin-top: 0px; margin-bottom: 0px;" href="http://www.yorksj.ac.uk/">www.yorksj.ac.uk</a> </span></p>
</td>
</tr>
<tr>
<td style="padding: 0cm 5.4pt; vertical-align: top; width: 303.75pt; height: 74.7pt;">
<p style="margin: 0cm; font-family: Calibri, sans-serif; font-size: 11pt;" class="elementToProof">
<span style="font-family: Arial, sans-serif; font-size: 12pt;"><b><img style="max-width: 100%; margin-top: 0px; margin-bottom: 0px;" size="12155" data-outlook-trace="F:1|T:1" src="cid:f8e2c6fa-d8f6-440a-9631-296584de1575"> </b></span></p>
</td>
</tr>
</tbody>
</table>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Steven Premeau via users <users@shibboleth.net><br>
<b>Sent:</b> Wednesday, August 6, 2025 5:07 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Cc:</b> Steven Premeau <steven.premeau@maine.edu><br>
<b>Subject:</b> Re: Searching Active Directory and LDAP Directory</font>
<div> </div>
</div>
<div>
<table border="0" cellspacing="0" cellpadding="0" align="left" width="100%">
<tbody>
<tr>
<td style="background:#ffb900; padding:5pt 2pt 5pt 2pt"></td>
<td width="100%" cellpadding="7px 6px 7px 15px" style="background:#fff8e5; padding:5pt 4pt 5pt 12pt; word-wrap:break-word">
<div style="color:#222222"><span style="color:#222; font-weight:bold">Caution:</span> Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.
</div>
</td>
</tr>
</tbody>
</table>
<br>
<div>
<div dir="ltr">Alberto -
<div><br>
</div>
<div> Generally, when the question is "Is it possible for Shibboleth to ...?", the answer is yes. That said, this is a topic where I think you should spend time thinking about whether you SHOULD attempt it.</div>
<div><br>
</div>
<div> The examples that I could find [1][2] do not seem to fully match what you are seeking. For example, both assume the directories would be using the same application (and schema), if I am reading your question correctly, you would have two different types
of directory.</div>
<div><br>
</div>
<div> Authentication should be the "easy" part, since it would primarily be taking the provided information and attempting to search and/or bind with the directory. Once you are able to get authentication working, you will likely need to tackle how attribute
resolution and other parts of your post-authentication process works.</div>
<div><br>
</div>
<div> Testing would be critical... you specifically mention "exists"...</div>
<div><br>
</div>
<blockquote style="margin:0 0 0 40px; border:none; padding:0px">
<div>what should happen if (when) there is an overlap in the directories, especially when there's a mismatch in passwords (e.g. authentication fails) or account status (e.g. the account exists in both directories, but is disabled or locked-out in one of them)?</div>
<div><br>
</div>
</blockquote>
<blockquote style="margin:0 0 0 40px; border:none; padding:0px">Are both directories providing enough information to accurately manage unique identifiers? <br>
<br>
</blockquote>
Additionally, if the end goal is to allow account holders in two separately managed and distinctly "scoped" identity stores to authenticate to a single application, the better approach would likely be stand up a separate identity provider for each identity
store and leverage discovery (or if the application doesn't support multiple identity providers, a middle-thing) to direct the authentication request to the proper location.
<div><br>
</div>
<div>Ultimately, while this is likely technically possible with the Shibboleth IDP, whether you SHOULD or not is a much bigger discussion than the technical implementation and dependent on the details specific to your environment and goals, something that is
normally best handled through some form of professional services conversation.</div>
<div><br>
</div>
<div>Steve.</div>
<div><br>
</div>
<div>[1] - <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration#Chaining-LDAP-validators" originalsrc="https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration#Chaining-LDAP-validators">https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration#Chaining-LDAP-validators</a></div>
<div>[2] - <a href="https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Solutions/HOWTO%20Configure%20a%20Shibboleth%20IdP%20v4.x%20to%20authenticate%20users%20existing%20on%20different%20LDAP%20Servers.md" originalsrc="https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Solutions/HOWTO%20Configure%20a%20Shibboleth%20IdP%20v4.x%20to%20authenticate%20users%20existing%20on%20different%20LDAP%20Servers.md">https://github.com/ConsortiumGARR/idem-tutorials/blob/master/idem-fedops/HOWTO-Shibboleth/Solutions/HOWTO%20Configure%20a%20Shibboleth%20IdP%20v4.x%20to%20authenticate%20users%20existing%20on%20different%20LDAP%20Servers.md</a>
(Note: HOWTO is based on the now unsupported IDP 4)</div>
<div><br>
</div>
<div><br>
</div>
</div>
<br>
<div class="x_gmail_quote x_gmail_quote_container">
<div dir="ltr" class="x_gmail_attr">On Wed, Aug 6, 2025 at 10:52 AM Alberto DeAngelis via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div class="x_msg-8197875029092533971">
<div dir="ltr">
<div style="line-height:normal; margin:0px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello,</div>
<div style="line-height:normal; margin:0px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="line-height:normal; margin:0px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Would it be possible to do a “Search Active Directory” and then “Search LDAP directory”. So for instance, if a user exists in Active Directory then Shib authentication. If the user doesn’t exist in Active Directory, then it searches LDAP. Is that possible?</div>
<div style="line-height:normal; margin:0px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="line-height:normal; margin:0px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thank you,</div>
<div style="line-height:normal; margin:0px; font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Alberto</div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_m_-5864623708239714619Signature">
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(4,106,56); font-weight:bolder">Alberto DeAngelis '20 '22</span><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><br>
</span><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(4,106,56)"><i>Database Administrator<br>
Information Technology Services</i></span><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><br>
</span><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(57,57,57)"><img height="54" width="170" alt="Manhattan University Logo/Shield" style="width:170px; height:54px; max-width:780px; box-sizing:border-box"></span><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><br>
</span><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(57,57,57)">Riverdale, NY 10471</span><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><br>
</span><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(57,57,57)">Phone: 718-862-7871</span><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><br>
</span><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(50,98,149)"><u><a href="mailto:adeangelis01@manhattan.edu" target="_blank" style="color:rgb(50,98,149); text-align:left">adeangelis01@manhattan.edu</a></u></span><span style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)"><br>
</span><span style="font-family:Georgia,sans-serif; font-size:14px; color:rgb(50,98,149)"><u><a href="http://www.manhattan.edu/" originalsrc="http://www.manhattan.edu/" target="_blank" style="color:rgb(50,98,149); text-align:left">www.manhattan.edu</a></u></span></div>
<div style="font-family:Aptos,Aptos_EmbeddedFont,Aptos_MSFontService,Calibri,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" originalsrc="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</div>
</blockquote>
</div>
</div>
</div>
<img src="https://www.yorksj.ac.uk/media/content-assets/safe-images/brand-guidelines/downloads/Social-Inclusion-Main-Email-Header_2024-11-25_09-03-43-949.png" alt="York St John University is the University of the Year for Social Inclusion in The Times and Sunday Times Good University Guide 2025">
</body>
</html>