Advice on planned IdP configuration changes associated with implementing SAML 2

[Cantor, Scott]

On 9/11/13 10:49 AM, "Jan Keirse" <jan.keirse at tvh.be> wrote:

>Assuming you have an account that has access to the 3rd party
>applications through the regular IDP, it should not be very hard to
>test with a test IDP. What I do when I plan big changes is to set up a
>VM with the exact same configuration, hostname, certificates,... as
>the live IdP. Because the host is not in the DNS server configuration
>nobody uses this VM. After making the configuration change to the VM I
>change my /etc/hosts or C:\Windows\System32\drivers\etc\hosts file so
>that the hostname of the real IdP points to the VM. I can then log in
>to all SP's with that VM to verify the config is valid.

That works fine as long as you aren't altering metadata. With a change
like moving to SAML 2, you can't do that by itself and test anything.

But it *is* by far the best way to test changes internal to your
environment.

-- Scott