Multiple LDAP domains
There is a growing need for your product users to be able to authenticate across multiple Lightweight Directory Access Protocols (LDAPs). Sometimes large organizations might have an LDAP domain controller for different global regions or subsidiaries.
Users can have a mix of directory types such as AD, Tivoli, OpenLDAP, and more.
Users can configure multiple directories in the LDAP configuration in your product. Your product uses WebSphere Liberty Server OpenID Connect 
as an authentication service which does administration and authentication against the appropriate directory.
- In the login dashboard, only one LDAP authentication entry is available for authentication against an LDAP. On the Identity Management login page, a single login entry point is available even if multiple LDAP directories are configured. For example, if you have three LDAP connections, three LDAP login options are not supported.
- Authentication against multiple LDAPs is possible only if WebSphere Liberty is configured to federate the directories correctly. The Identity Management login page doesn't display multiple login options, but the backend can query more than one directory if the federation is properly defined. For more information, see Connecting to your LDAP directory.
- An LDAP username must be unique across all LDAP connections. Duplicate usernames are not allowed. If one username is in one LDAP server, avoid using the same username in another LDAP server.
- If an LDAP connection is broken, the LDAP is not responding and times out, and the LDAP authentication doesn’t work even for the default
cpadminadmin login.
Multiple LDAP registration
As a cluster administrator, you can configure multiple LDAP domains by adding multiple directory entries to the LDAP configuration in server.xml.
In a multiple domain configured environment, a new user administration on your product platform enforces a selection of appropriate domains and the user is added to the Team.
The user profile and the domain name is maintained by your product and is further used for user management. The ability to chose domain before selecting users, such as for a team, allows administrator to isolate teams with a specific domain.