Changing domain name

[Michael A Grady]

Illinois changed from "uiuc.edu" to "illinois.edu" starting back about 2007. But retained both domains, and continue to forward email directed to an "@uiuc.edu" address to the "@illinois.edu" address. And even given this was back before we had nearly the number of federated connections as there are today, or any campus-arranged cloud services, etc., Illinois has never changed its entityID from the original URN form with uiuc.edu in it. It's just an internal name, the the usual reason for institutional domain name changes is Public Relations/"Institutional Identity". If the "public" sees the name, it is  in scope to be changed, otherwise it can usually be left alone.

This was a *big deal*, the campus payed for a dedicated project manager to oversee all the different threads, activities, units, etc. that needed to be involved, and played out over several years. We did get permission to have our InCommon IdP entry list two allowed scopes to be asserted for some period of transition time - uiuc.edu and illinois.edu.

The main campus page about that project can be found at:

 http://illinoisdomainproject.illinois.edu/

There was, of course, much more internal documentation, project tracking pages, etc. Guidelines on how to handle the transition in server certificate names, etc.

Given the much greater complexity of federated connections, cloud services, etc. in play today, I sure wouldn't want to be involved in such a project today.

On Jan 30, 2013, at 9:40 AM, Cantor, Scott wrote:

> On 1/30/13 10:36 AM, "Peter Schober" <peter.schober at univie.ac.at> wrote:
> 
>> * Tom Scavo <trscavo at gmail.com> [2013-01-30 16:27]:
>>> If you count the effect on users (that rely on cookies for discovery),
>>> the effect of a change to the IdP entityID is probably on par with the
>>> SP. We're approaching near zero tolerance for changing any entityID.
>>> Assurance is another area that is adversely affected by such a change.
>> 
>> Assuming the institution will still own/control the old domain I wouldn't
>> change the entityID and also keep the old scope around in metadata
>> (provided InCommon allows you to keep urn:mace:incommon:muohio.edu, no
>> idea what the rules are for that),
> 
> (To be clear, I wouldn't want to change it either, but if one is giving up
> control of a domain, they may not have a choice.)
> 
> But you raise a good point, scope is a much bigger deal. You'd end up
> breaking every application storing usernames. That's like a mass name
> change.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.