multiplexing IdP configurations

[Tom Scavo]

We run both Shibboleth and simpleSAMLphp here. We have two instances
of SSP running as gateways but Shibboleth IdPs everywhere else. This
division of labor seems to work pretty well for us. I'm telling you
this because it provides context for the feature I'm about to ask for
:-)

SSP has this wonderful feature that I'll call "multiplexing
configurations" for lack of a better word. Here's a use case: We are
introducing new endpoints into our IdP Proxy currently running in
production. On the IdP side of the IdP Proxy (which faces multiple
external SPs), SSP can be configured to automatically multiplex
between two configurations, each identical in every respect except the
endpoints. This allows us to migrate our external SPs at our leisure,
with zero down time.

This use case comes up in the InCommon Federation all the time (and
I'm sure you're no stranger to it as well). Making changes to IdP
metadata is almost guaranteed to cause an outage (except for cert
migration) so deployers are well advised to stabilize everything else.
But you how it goes. It's a common situation for an org to migrate to
a new primary domain. Having the ability to support that use case
seamlessly at the IdP would be a huge win.

Tom