Aggregate Pass Through Authentication Handler

Note: this component is designated "advanced", which means that objects of this type are not expected to be created or altered in most environments. If you believe that such a change is necessary, you may want to contact support in order to understand the potential impact of that change.

Aggregate Pass Through Authentication Handlers provide a mechanism for invoking one or more other pass-through authentication handlers in the course of processing a single operation.

Ideally, each subordinate pass-through authentication handler should be configured with mutually exclusive sets of criteria and/or included base DNs so that each bind request is only applicable to at most one of the subordinate handlers. If there are cases in which a single bind request might need to be evaluated by multiple pass-through authentication handlers, then the continue-on-failure-type property must be configured to allow at least certain types of failures from the initial handler to be at least temporarily overlooked in the hopes that a subsequent handler will be able to more correctly process the request.
Pass-through authentication processing for this handler will try the subordinate handlers in the order in which they are configured. It will use the following logic for processing an authentication attempt:

1. If the current subordinate authentication is not applicable to the bind operation being processed (for example if the target user is not below an included base DN for the handler, or if the bind operation does not match a connection or request criteria configured for the handler), then the subordinate handler will be skipped and the next one in the list will be evaluated.
2. If the current subordinate authentication handler completes with a successful authentication, then its result will be used.
3. If the current subordinate authentication handler fails with a result that is not included in the set of values for the continue-on-failure-type property, then its result will be used.
4. If the current subordinate authentication handler fails with a result that is included in the set of values for the continue-on-failure-type property, then its result will be collected in a list and the next subordinate handler in the list will be attempted.
5. If all of the subordinate authentication handlers have been exhausted and all of the handlers were skipped because they were not applicable for the bind operation (that is, no failures were encountered), then bind processing will proceed as if the pluggable pass-through authentication plugin had not been enabled.
6. If all of the subordinate authentication handlers have been exhausted and all of the failures encountered were of the same type (which must have been in the set of continue-on-failure-type values), then the authentication attempt will fail with that reason and the failure message will be an aggregate of all of the subordinate failures.
7. If all of the subordinate authentication handlers have been exhausted and there were multiple failure types, then the authentication attempt will fail with a failure result code of "other-failure" and the failure message will be an aggregate of all of the subordinate failures.

dsconfig Usage

To list the configured Pass Through Authentication Handlers:

dsconfig list-pass-through-authentication-handlers
     [--property {propertyName}] ...

To view the configuration for an existing Pass Through Authentication Handler:

dsconfig get-pass-through-authentication-handler-prop
     --handler-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Pass Through Authentication Handler:

dsconfig set-pass-through-authentication-handler-prop
     --handler-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new Aggregate Pass Through Authentication Handler:

dsconfig create-pass-through-authentication-handler
     --handler-name {name}
     --type aggregate
     --set subordinate-pass-through-authentication-handler:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Pass Through Authentication Handler:

dsconfig delete-pass-through-authentication-handler
     --handler-name {name}