moving relying service to new domain

[Tom Scavo]

On Mon, Jan 7, 2013 at 4:38 PM, David Bantz <dabantz at alaska.edu> wrote:
>
> The service owner of a local Shibboleth SP-protected service (on IIS)
> relying on our Shibboleth IdP is moving the service location into a
> different (local) domain.
>
> (1) Since the entityID is a name, not a location, seems that should be
> do-able without changing the IdP config - right?

Yes.

> (2) In the SP config, it appears the Site id under ISAPI does need to change
> to reflect the new location of the service - right?
> <Site id="1" name="service.originaldomain.edu"/>  -->  <Site id="1"
> name="service.newdomain.edu"/>

(someone else will have to answer that one)

> (3) If the above is remotely correct, that leaves the SP config with an
> entity ID that does not match the Site id; is that OK or discouraged?

There's no particularly good reason for the entityID to match the
hostnames used in endpoints. Some software (such as PEER) requires it,
and maybe some federations require it as well (InCommon does NOT) but
it's much important (as you've noted) that the entityID *never*
change.

Tom