Authenticate users with LDAP server - authentication

Question

I'm using LDAP Login Module to authenticate users with LDAP server in hybrid app. In authenticationConfig.xml I configured loginModule parameters.
<parameter name="ldapSecurityPrincipalPattern"
value="uid={username}, cn=users,dc=kadrlar,dc=uz"/>
<parameter name="ldapSearchFilterPattern"
value="(uid={username})"/>
<parameter name="ldapSearchBase"
value="dc=kadrlar,dc=uz"/>
Authentication works fine. This is one part of users.
I have some users in LDAP where I must use ldapSecurityPrincipalPattern with value="uid={username}, cn=users,dc=core,dc=kadrlar,dc=uz"/>
All other parameters are the same. This is another part of users.
How can I point the value of ldapSecurityPrincipalPattern to be able to authenticate any user from both parts of users without changing the value of ldapSecurityPrincipalPattern?

Answer 1

ldapSecurityPrincipalPattern is used to tell the LDAP adapter what identifying information is needed in order to successfully authenticate the user.
for example if your LDAP server was setup to use email, your pattern would be {username}#domain.com. Your question is equivalent to asking how to get the adapter to authenticate both {username}#google.com and {username}#stackoverflow.com, Which is obviously impossible since the LDAP adapter doesn't have the functionality to handle multiple attempts and the logic involved in dealing with a fail to connect and retrying using another security pattern.
A possible solution would be to set the the pattern as just {username},
and force the end user to pass in the full email address including the domain.
Similarly, in your case what you could do is set ldapSecurityPrincipalPattern to {username}, and introduce some logic in the implementation, that takes the login name from your end user,
and decide whether to set username="uid={login}, cn=users,dc=kadrlar,dc=uz"
or username="uid={login}, cn=users,dc=core,dc=kadrlar,dc=uz".