Question about AssertionConsumerService endpoints

[Ken Weiss]

We are in the process of updating an application that sits behind a
Shibboleth SP, and I have a question about the metadata.

Right now we have version 1 of the DMPTool application deployed behind
Shibboleth at https://dmp.cdlib.org. We are bringing up version 2 of this
application at https://dmp2.cdlib.org. However, after a initial testing
period, we will want to change the DNS entry for dmp.cdlib.org so it
points to dmp2.cdlib.org, and we would like this process to be transparent
to our users.

We have existing metadata registered with InCommon for DMPTool v1 that
looks like this:

<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/POST" index="1"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML2/POST" index="2"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/Artifact" index="3"/>


Can I register a second EntityDescriptor that uses the same endpoints?
What I would like to do is register something that looks like this:

<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML/POST" index="1"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML2/POST" index="2"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML/Artifact" index="3"/>
<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/POST" index="4"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML2/POST" index="5"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/Artifact" index="6"/>

My hope is that after we change the DNS for dmp.cdlib.org so that it is
hitting the Shibboleth SP on dmp2.cdlib.org, the authentication process
would still work, even for people that got there by entering
https://dmp.cdlib.org. Will it? Or will InCommon refuse to register the
same URL for endpoints in two different EntityDescriptors?



--Ken


------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612