Convert native Shibboleth SP installation to Shibboleth SP using InCommon metadata

[Jason Johnson]

Scott,

Thanks for the info. This is all confusing for me so I'm sure my use of
terms or how I understand them may be incorrect.
I'm used to going to https://somesite/Shibboleth.sso/Metadata in order to
generate the metadata for each client site for them to install on their IdP.
My confusion was that there is nothing that tells that to get things
remotely.  Or I was just doing it wrong.

And, yes, I am looking for multiple metadata sources - InCommon and
others.  What I would also like to do is the following:

1.  Have both site1.somewhere.com and site2.somewhere.com use a common SP -
sp.somewhere.com.  So, in each site, they would have a login link that
points to sp.somewhere.com/secure.  This should bounce the user to the
appropriate login for their site.  Do I have that logic right?

Thanks,
Jason
On Thu, Mar 15, 2012 at 4:56 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I am wanting to convert my existing Shibboleth SP installation from a
> native
> > (using local SP metadata file AND connecting to IDPs using local metadata
> > files) to an InCommon/Shibboleth SP installation (with my SP metadata
> being
> > pulled from InCommon).
>
> Your terminology is confusing here, but to start with, the SP doesn't use
> "SP metadata", only IdP metadata. So if you're saying you want the SP to be
> provisioning its IdPs from InCommon instead of a local file, I get it.
>
> >  My biggest hurdle is I don't see where in the
> > shibboleth2.xml file I need to specify that my SP metadata is to now be
> > supplied remotely.
>
> Again, you don't use SP metadata. You specify IdP metadata remotely by
> using the XML provider with a url or uri attribute instead of a file or
> path attribute, and the various other trust related filtering you need.
>
> >  I have seen this line mentioned a few times in other posts:
>
> InCommon has documentation that outlines how to provision the SP with
> their metadata, yes.
>
> > However, I was under the impression that this XML attribute was to tell
> > Shibboleth how to interact with the IDPs.  Do I have that wrong?  Does it
> > control both??
>
> Both what?
>
> > 1.  Use my new InCommon SP metadata for all my connections
> > 2.  Use InCommon IDPs for those that are in InCommon
> > 3.  Use local IDP metadata files for those not in InCommon
> > 4.  All this using one Shibboleth installation.
>
> That just means you need multiple metadata sources, InCommon and others.
>
> I think you're under the impression that the SP being "in InCommon" has
> some impact on its configuration as an SP, but it really doesn't.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 

…………………………
Jason Johnson
Terra Dotta, LLC
501 W. Franklin Street, Suite 105
Chapel Hill, NC 27516
Phone/Fax: 877-DOTTA-77 (877-368-8277) x111
http://TerraDotta.com <http://terradotta.com/>

*Register for Terra Dotta University in Charlotte, NC: April 18-20,
2012*<https://university.terradotta.com/index.cfm?FuseAction=Abroad.ViewLink&Parent_ID=0&Link_ID=7AD7CAC2-E525-4C47-3EA59E2DD4EBF068>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20120316/586eae25/attachment.html