Administration tools for Shibboleth?

[Peter Schober]

* David Gersic <dgersic at niu.edu> [2013-03-06 16:37]:
> >>> On 3/5/2013 at 07:32 PM, "Erdos, Marlena" <marlena_erdos at harvard.edu> wrote: 
> > Hi Shib Users,
> > 
> > Are you using a tool to administer your IdP? If so, my colleagues and I
> > would love to hear about it.
> 
> What's to administer? I set up the IdP. It runs. There's not much
> else it needs to have done to it as far as administration goes.

Well, scalable attribute release is an issue for many, and
hand-enabling new SPs does not scale well. Not enabling severly
reduces the stuff people have access to.
Having config autoreloading in place for pulling in changed resolver
or filter configs is not common (but available in the software), as
are HA/clustered approaches, so making /any/ config change will cause
outages and may require "maintenance windows". That in turn does not
increase the willingness or frequency of config changes or software
updates. Same thing for branding the IdP pages (which is solved in
both the OSU login handler and the v3 IdP).

Keeping up with releases is an issue too, but that will only get
better once we have OS packages for distribution and updates (i.e.,
not by some GUI/"wizard" thingy). At least people then will have an
excuse less.
With updates come new features, and you'll have to enable those in the
configuration. You copy & paste examples from the wiki (or elsewhere
on the net) and find the default XML namespace does not match or the
used namespace is not bound to a prefix in your config. Of course you
only learn about that when the servlet container fails to re-start,
which quickly leads to "never touch a running system" syndrome.

Often neough I just hear "XML (or Java, meaning Tomcat) is hard", even
for trivial changes. (And no, I don't think JSON would improve this
even a bit.)
-peter