Migrating Idp from 1.x to 2.x

[Chad La Joie]

In general that sounds fine. Just a few comments:

IdP v2 allows you to simply your infrastructure in certain ways:
- ability to perform authentication against LDAP or Kerb KDCs directly
without relying on container or web server
- ability to run without a web server in front of the container
- ability to pull in and automatically refresh metadata from a URL or
the filesystem
I recommend you take full advantage of those.  The fewer processes
your running the fewer that can break and take down your
infrastructure.

I would recommend moving to URL based entity IDs.  When you installed
IdP 2.x it will have generated one for you using the standard
algorithm used by the Shib IdP and SP.  I thought InCommon recommended
this now too but I don't know for sure, you'd have to ask them.

The last thing I'll point out is that some SPs maintain metadata
locally (even if they originally got it from a centralized file like
InCommon's metadata aggregate).  So, it's quite possible that you'll
never see all the traffic on the old IdP go away until you go knocking
on the SPs door and give them your new metadata document (and strongly
suggest they start doing something sensible and load metadata from one
of these maintained aggregates).

On Wed, Feb 22, 2012 at 07:37, Bryan E. Wooten <bryan.wooten at utah.edu> wrote:
> All,
>
>
>
> I need to migrate from 1.x to 2.x by the end of the month.
>
> Our current 1.x Shib is located at incommon.sso.utah.edu. I would like to
> bring up Shib 2.x located at incommon2.sso.utah.edu.
>
> At this point we would update our metadata with the Incommon Federation,
> while leaving our Shib 1.x up and running.
>
>
>
> Service providers that import new metadata would begin using the new 2.x Idp
> immediately. We would then monitor the access logs for activity on the 1.x
> Idp
>
> And when there was no more activity we would retire the 1.x Idp. (We don’t
> have that many Sps using our Idp). We would try and find contact information
>
> for the Sps using our 1.x Idp and encourage them to import new metadata to
> speed up the process.
>
>
>
> Any thoughts?
>
>
>
> Thanks,
>
>
>
> Bryan
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
Chad La Joie
www.itumi.biz
trusted identities, delivered