Changing domain name

[Kidd, Don]

Thanks for the feedback and advice so far, its been great.  You guys have
all touched on things that I've been concerned with as well.  I'm hoping
that I can keep our entityID as well, and I am scared of the ripples if we
start changing our scoped values.  We have the same plan where if the
"public" sees the name, its in scope to be changed.

Thanks again,
Don

--------
Don W. Kidd
Senior Systems Analyst
dkidd at MiamiOH.edu
513.529.9655

[image: PastedGraphic-1.tiff]

“If your actions inspire others to dream more, learn more, do more and
become more, you are a leader.”  -- John Quincy Adams




On Wed, Jan 30, 2013 at 11:34 AM, Michael A Grady <mgrady at unicon.net> wrote:

>
> On Jan 30, 2013, at 10:30 AM, Michael A Grady wrote:
>
> > Illinois changed from "uiuc.edu" to "illinois.edu" starting back about
> 2007. But retained both domains, and continue to forward email directed to
> an "@uiuc.edu" address to the "@illinois.edu" address. And even given
> this was back before we had nearly the number of federated connections as
> there are today, or any campus-arranged cloud services, etc., Illinois has
> never changed its entityID from the original URN form with uiuc.edu in
> it. It's just an internal name, the the usual reason for institutional
> domain name changes is Public Relations/"Institutional Identity". If the
> "public" sees the name, it is  in scope to be changed, otherwise it can
> usually be left alone.
> >
> > This was a *big deal*, the campus payed PAID for a dedicated project
> manager to oversee all the different threads, activities, units, etc. that
> needed to be involved, and played out over several years. We did get
> permission to have our InCommon IdP entry list two allowed scopes to be
> asserted for some period of transition time - uiuc.edu and illinois.edu.
> >
> > The main campus page about that project can be found at:
> >
> > http://illinoisdomainproject.illinois.edu/
> >
> > There was, of course, much more internal documentation, project tracking
> pages, etc. Guidelines on how to handle the transition in server
> certificate names, etc.
> >
> > Given the much greater complexity of federated connections, cloud
> services, etc. in play today, I sure wouldn't want to be involved in such a
> project today.
> >
> > On Jan 30, 2013, at 9:40 AM, Cantor, Scott wrote:
> >
> >> On 1/30/13 10:36 AM, "Peter Schober" <peter.schober at univie.ac.at>
> wrote:
> >>
> >>> * Tom Scavo <trscavo at gmail.com> [2013-01-30 16:27]:
> >>>> If you count the effect on users (that rely on cookies for discovery),
> >>>> the effect of a change to the IdP entityID is probably on par with the
> >>>> SP. We're approaching near zero tolerance for changing any entityID.
> >>>> Assurance is another area that is adversely affected by such a change.
> >>>
> >>> Assuming the institution will still own/control the old domain I
> wouldn't
> >>> change the entityID and also keep the old scope around in metadata
> >>> (provided InCommon allows you to keep urn:mace:incommon:muohio.edu, no
> >>> idea what the rules are for that),
> >>
> >> (To be clear, I wouldn't want to change it either, but if one is giving
> up
> >> control of a domain, they may not have a choice.)
> >>
> >> But you raise a good point, scope is a much bigger deal. You'd end up
> >> breaking every application storing usernames. That's like a mass name
> >> change.
> >>
> >> -- Scott
> >>
> >>
> >> --
> >> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> >
> >
> > --
> > Michael A. Grady
> > Senior IAM Consultant, Unicon, Inc.
> >
> > --
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
> --
> Michael A. Grady
> Senior IAM Consultant, Unicon, Inc.
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130131/37f40cfd/attachment.html