multiplexing IdP configurations

[Tom Scavo]

On Fri, Mar 27, 2015 at 1:36 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 3/27/15, 9:34 AM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>>SSP has this wonderful feature that I'll call "multiplexing
>>configurations" for lack of a better word. Here's a use case: We are
>>introducing new endpoints into our IdP Proxy currently running in
>>production. On the IdP side of the IdP Proxy (which faces multiple
>>external SPs), SSP can be configured to automatically multiplex
>>between two configurations, each identical in every respect except the
>>endpoints. This allows us to migrate our external SPs at our leisure,
>>with zero down time.
>
> I don't think I know what it is you're describing. I realize you're approximating the description and just coining a term for it, so that's probably not too surprising, but I'm not quite getting it yet.

Yeah, sorry, I don't want to waste your time, so I'll try once more
and see how it goes.

> If you're trying to add endpoints, that's not new, even V2 could do that

If it can do that, I'll be pleasantly surprised (and embarrassed about
all the people who have sweat brass tacks because of my bad advice :)

> but I don't think that's what you're after...

You can only have one inbound HTTP-Redirect endpoint (e.g.) at the
IdP. If you want to change the location of that endpoint, you
necessarily break interoperability until your SP partners have updated
their metadata.

I know I'm comparing apples to oranges when I say simpleSAMLphp can
accommodate that use case. It essentially looks at the incoming
request and does the right thing on-the-fly. The SSP IdP can remain
configured that way indefinitely, for as long as it takes laggard SPs
to update their metadata.

Does that help?

Tom