Can Shibboleth IdP handle something like Domain/Group?

[Christopher Bongaarts]

On 7/2/2013 10:23 PM, David Bantz wrote:
> When this was proposed to me I hinted at Scott's answer by asking whether it would really be any easier to manage one complex instance rather than five on separate VMs.  The answer seems to be that it is mainly convenient for the server admins; multiple servers for them to administer and update versus one server; the more complex application layer isn't their problem and I was directed to investigate the possibility.

If your server admins are using a reasonable configuration management 
tool, spinning up a few extra VMs shouldn't be a big deal ;)

We have about 6 or so IdP instances (prod, test, "spoofable" versions of 
the latter two, load test, and development).  We have separate test and 
prod LDAP directory instances, and only prod and prod-spoof point to the 
production directory.   (If we hadn't had a test directory already, I 
likely would echo Eric G.'s comment that adding an IdP instance is less 
work than standing up a test directory instance...)

We happen to use separate VMs for these functions, but as others have 
noted you can run multiple IdPs on the same VM.  We like to have them 
separate to ensure that e.g. pounding on the load test instance doesn't 
disrupt production.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%