entityID and multiple application instances

[Brian Tingle]

Thanks for the answers, I think I understand now.

The point of "Unlike the endpoint locations, the entity ID accurately reflects the organization that owns the entity. Endpoint locations, on the other hand, are resolvable DNS names." is to say that the entityID will be composed with a hostname inside of it that can be traced back to the organization that controls the metadata; but the actual server the user goes to could be different if a third party provider is involved.  It really has nothing to do with my use case of dev, stage, and production.

The key point with regard to my question is that there is a one-to-one relationship between entityID and sp-key.pem/sp-cert.pem created by `make install` ; one entityID for all instances is possible but requires manually creating metadata XML.

Thanks for the info on metadata delegation: we have dozens of applications we need to shibbolize x dev,stage,prod --getting one of these delegate accounts might be a good idea.

I have another related question re: " However, SAML V2.0 defines a fairly obvious way of obtaining metadata about a given entity by resolving an entityID URL (see section 4.1 of the SAML Metadata Specification)." on https://wiki.shibboleth.net/confluence/display/SHIB2/EntityNaming -- does this suggest I should use http://nuxeo-dev.cdlib.org/Shibboleth.sso/Metadata as my entityID?  It seems to meet the section 4.1 requirements.

Thanks again -- Brian