Advice on planned IdP configuration changes associated with implementing SAML 2

[Julian Williams]

On 11/09/13 16:02, Cantor, Scott wrote:
> On 9/11/13 10:49 AM, "Jan Keirse" <jan.keirse at tvh.be> wrote:
>
>> Assuming you have an account that has access to the 3rd party
>> applications through the regular IDP, it should not be very hard to
>> test with a test IDP. What I do when I plan big changes is to set up a
>> VM with the exact same configuration, hostname, certificates,... as
>> the live IdP. Because the host is not in the DNS server configuration
>> nobody uses this VM. After making the configuration change to the VM I
>> change my /etc/hosts or C:\Windows\System32\drivers\etc\hosts file so
>> that the hostname of the real IdP points to the VM. I can then log in
>> to all SP's with that VM to verify the config is valid.
>
> That works fine as long as you aren't altering metadata. With a change
> like moving to SAML 2, you can't do that by itself and test anything.
>
> But it *is* by far the best way to test changes internal to your
> environment.

Thanks for that. I hadn't considered testing like this but will do in 
future, though I take the point that it won't help with testing any 
metadata changes.

-Julian