entityID and multiple application instances

[Ian Young]

On 6 Jun 2013, at 08:01, Brian Tingle <Brian.Tingle at ucop.edu> wrote:

> Should one entityID be used for -dev, -stg, and production; or three?  If either option is possible; which is preferred?

You can take either approach, or any combination of the two.  Which is better for you will depend on circumstances, and there are tradeoffs.  There are examples of each, so it's hard to say that either option is preferred in general.

Having a separate entityID for each variant is the most straightforward because you don't need to manually combine the metadata.  This means there's no way for you to make a mistake when you manually combine the metadata ;-)  It also separates attribute release for the different sites: for example, your customers may be uncomfortable with releasing personal data to a development site which may be less robustly secured.  A staging site is probably in the grey area where this is concerned: if you want to do customer acceptance testing on the staging site then combining it with the production site means that the customer doesn't have to configure separate attribute release for the two entities.

> Should I think of the entityID as representing my application, a particular instance of my application, or something that reflects the organization that owns the application?


If I had to choose between those options, I'd generally pick 2 over 1.  3 isn't an option at the same level but is reflected in the requirement that you own the domain in the entityIDs you use; no-one is suggesting that all your applications need to be squeezed in under a single entityID.

	-- Ian



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130606/b13340ba/attachment-0001.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4813 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20130606/b13340ba/attachment-0001.bin