Question about AssertionConsumerService endpoints

[Ken Weiss]

Scott,

I never realized that two SPs on two different hosts could share a common
EntityDescriptor and metadata. I just assumed it was a 1:1 relationship.
But thinking about it, it makes perfect sense. How else would you manage a
farm of servers that all deliver the same application, but each with its
own shibd installation?

So what I'm hearing is that my operational goal is achievable, but in a
much simpler way than what I proposed. What I actually want in my metadata
is something like this:

...
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML/POST" index="1"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML2/POST" index="2"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML/Artifact" index="3"/>
<md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/POST" index="4"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML2/POST" index="5"/>
    <md:AssertionConsumerService
xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/Artifact" index="6"/>
...

Today that will route requests for https://dmp.cdlib.org to
cdl-dmpv1.ucop.edu (the actual hostname that dmp.cdlib.org resolves to),
and requests for https://dmp2.cdlib.org to cdl-dmpv2.ucop.edu (the actual
hosthame that dmp2.cdlib.org resolves to). When we complete the transition
from version 1 to version 2, we will change the DNS so that dmp.cdlib.org
resolves to cdl-dmpv2.ucop.edu, and then all requests will go to version 2
of our service and we can shut down the SP running at cdl-dmpv1.ucop.edu.
Right?

Sorry to be so persistent, because I think you already did answer my
question, but I just want to be certain I really understood your answer.

--Ken

------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612






On 1/17/14 11:30 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 1/17/14, 2:23 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:
>>
>>Can I register a second EntityDescriptor that uses the same endpoints?
>
>Yes, but why would you? Just add the new endpoints to the existing one.
>
>-- Scott
>
>>My hope is that after we change the DNS for dmp.cdlib.org so that it is
>>hitting the Shibboleth SP on dmp2.cdlib.org, the authentication process
>>would still work, even for people that got there by entering
>>https://dmp.cdlib.org. Will it? Or will InCommon refuse to register the
>>same URL for endpoints in two different EntityDescriptors?
>
>It won't, but that's not the right approach. You are changing your
>entityID by doing this, and that violates the first and primary point of
>having them.
>
>-- Scott
>
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net