We've just installed MH at our University (U of Helsinki, Finland) in a 4-server setup. Being at the first steps of our installation procedure, we haven't yet implemented the auth part but it is in our project roadmap to use LDAP/AD/Shibboleth.
At first we though we'd use LDAP/AD, but after some deeper thinking, it now seems we need to try Shibboleth as it would give us SSO and thus also a very easy integration to our Moodle, Wiki and Dspace etc (which all use Shibboleth). That said, I think there must be many other Universities who use Shibboleth as well and thus I'd want to hear if anyone else is trying to set up MH to auth via Shibboleth. Now, I don't know if it is common but at least in our University we utilize both Shibboleth and LDAP at the same time in some of our services (e.g. wiki). We do this to solve the different needs of authentication (a user) and authorization (granting access to a user, users - or to an ldap group, for example). In our wiki, for example, we use Shibboleth only for the auth part but LDAP for syncing the LDAP groups and group memberships to the wiki db. I'm not saying this is the best way to do it, but it seems to work well. So, when it comes to the user and group memberships and storing that data in MH, at least I would appreciate it if the sysadmins could hook their MH into an ldap server for the group data but still be able to use e.g. Shibboleth to do the auth part. Now, as a newbie MH installer, this all might sound stupid and against the java application development principles (of which I know unfortunately little). I don't know if it is in the MH design guidelines to avoid storing lots of users or group data into the MH database, but for me at least it seems that many of our University teachers and students would require individual users to be found in the db along with our LDAP groups. I say this because we have had very similar requirements in our wiki, Moodle etc systems, and we've been forced to sync our 50000+ user and 1500+ LDAP group databases into those systems, even though we've initially said "no go" to those needs. Yours, Olli S. from Finland PS: don't know what would be the most beautiful way to do that kind of LDAP group data updates, but for me it seems a natural way would be to use REST, or at least make the necessary database tables ready for those who want to sync their data via a shell script, or something like that... -- View this message in context: http://opencast.3480289.n2.nabble.com/Authorization-with-spring-security-and-ldap-tp5561454p6079920.html Sent from the Opencast Matterhorn mailing list archive at Nabble.com. _______________________________________________ Matterhorn mailing list [email protected] http://lists.opencastproject.org/mailman/listinfo/matterhorn To unsubscribe please email [email protected] _______________________________________________
