entityID and multiple application instances

[Tom Scavo]

On Thu, Jun 6, 2013 at 3:01 AM, Brian Tingle <Brian.Tingle at ucop.edu> wrote:
>
> https://spaces.internet2.edu/display/InCFederation/Entity+IDs
>
> ...
> looking at the metadata in EntitiesDescriptor it looks like I should have
> one entityID for nuxeo-dev.cdlib.org, a second for nuxeo-stg.cdlib.org, and
> a third for nuxeo.cdlib.org?

Ian already gave a great answer to that question.

> Should I think of the
> entityID as representing my application, a particular instance of my
> application, or something that reflects the organization that owns the
> application?

There is no one right answer. There are numerous examples of (1) and
(2) in InCommon metadata. There are a couple of examples of (3) in
InCommon metadata and with the rise of SaaS apps, I expect more of
these. Let me give a specific (hypothetical) example of the latter,
from the campus point of view:

A campus runs a help desk service. Today the help desk software is
locally hosted on the campus. It has a federated login interface so
that users can log in with their campus username and password. The
entityID and endpoint locations in the SP metadata shared with the
campus IdP are based on the DNS name "helpdesk.example.edu".

Now suppose the campus decides to move this service to the cloud. The
SaaS app supports SAML (or maybe OpenID Connect) and is flexible
enough so that exactly the same metadata can be used. When the switch
is made from the local app to the cloud app, the IdP won't be able to
tell the difference. There will be no down time. A couple of
well-placed redirects will mostly preserve the user experience.

As far as InCommon is concerned, the campus owns the service, before
and after the switch. More accurately, the campus owns and maintains
the metadata for the service. Moreover, the campus can delegate the
administration of that metadata to a third party
(https://spaces.internet2.edu/x/7ZiKAQ), perhaps someone employed by
the vendor of the SaaS app.

So if you're a vendor, and you support this level of integration,
campuses will view that as a big plus.

Tom