Question about AssertionConsumerService endpoints

[Ken Weiss]

I was just getting ready to simplify my metadata by setting up a single
EntityDescriptor with endpoints defined for all of my physical and virtual
hosts when I realized there is a potential issue.

Each host has its own instance of Shibboleth SP running. Each instance of
Shibboleth SP has its own certificate. Unless I make all the certificates
the same, only the SP with the certificate that matches what's in the
metadata will work.

Should I stick with my original plan and have a 1:1:1 relationship for
EntityDescriptor, host, and SP instance with associated certificate? Or
should I use a single EntityDescriptor with defined endpoints for each
possible hostname and use the same sp-cert.pem and sp-cert.key on all the
hosts?

All of the endpoints are subject to the same policies for authentication
and authorization. All are running the same application, just different
versions.

I realize that either scenario can be made to work. I'm just wondering if
there is consensus on the best practice for this particular situation.

--Ken

------------------------------------------------------------
Ken Weiss                                 ken.weiss at ucop.edu
UC Office of the President              510-587-6311 (office)
California Digital Library              916-905-6933 (mobile)
UC Curation Center
415 20th Street, 4th Floor
Oakland, CA 94612






On 1/17/14 1:52 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:

>Scott,
>
>I never realized that two SPs on two different hosts could share a common
>EntityDescriptor and metadata. I just assumed it was a 1:1 relationship.
>But thinking about it, it makes perfect sense. How else would you manage a
>farm of servers that all deliver the same application, but each with its
>own shibd installation?
>
>So what I'm hearing is that my operational goal is achievable, but in a
>much simpler way than what I proposed. What I actually want in my metadata
>is something like this:
>
>...
>    <md:AssertionConsumerService
>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
>Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML/POST" index="1"/>
>    <md:AssertionConsumerService
>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML2/POST" index="2"/>
>    <md:AssertionConsumerService
>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
>Location="https://dmp2.cdlib.org/Shibboleth.sso/SAML/Artifact" index="3"/>
><md:AssertionConsumerService
>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>Binding="urn:oasis:names:tc:SAML:1.0:profiles:browser-post"
>Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/POST" index="4"/>
>    <md:AssertionConsumerService
>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
>Location="https://dmp.cdlib.org/Shibboleth.sso/SAML2/POST" index="5"/>
>    <md:AssertionConsumerService
>xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
>Binding="urn:oasis:names:tc:SAML:1.0:profiles:artifact-01"
>Location="https://dmp.cdlib.org/Shibboleth.sso/SAML/Artifact" index="6"/>
>...
>
>Today that will route requests for https://dmp.cdlib.org to
>cdl-dmpv1.ucop.edu (the actual hostname that dmp.cdlib.org resolves to),
>and requests for https://dmp2.cdlib.org to cdl-dmpv2.ucop.edu (the actual
>hosthame that dmp2.cdlib.org resolves to). When we complete the transition
>from version 1 to version 2, we will change the DNS so that dmp.cdlib.org
>resolves to cdl-dmpv2.ucop.edu, and then all requests will go to version 2
>of our service and we can shut down the SP running at cdl-dmpv1.ucop.edu.
>Right?
>
>Sorry to be so persistent, because I think you already did answer my
>question, but I just want to be certain I really understood your answer.
>
>--Ken
>
>------------------------------------------------------------
>Ken Weiss                                 ken.weiss at ucop.edu
>UC Office of the President              510-587-6311 (office)
>California Digital Library              916-905-6933 (mobile)
>UC Curation Center
>415 20th Street, 4th Floor
>Oakland, CA 94612
>
>
>
>
>
>
>On 1/17/14 11:30 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>On 1/17/14, 2:23 PM, "Ken Weiss" <ken.weiss at ucop.edu> wrote:
>>>
>>>Can I register a second EntityDescriptor that uses the same endpoints?
>>
>>Yes, but why would you? Just add the new endpoints to the existing one.
>>
>>-- Scott
>>
>>>My hope is that after we change the DNS for dmp.cdlib.org so that it is
>>>hitting the Shibboleth SP on dmp2.cdlib.org, the authentication process
>>>would still work, even for people that got there by entering
>>>https://dmp.cdlib.org. Will it? Or will InCommon refuse to register the
>>>same URL for endpoints in two different EntityDescriptors?
>>
>>It won't, but that's not the right approach. You are changing your
>>entityID by doing this, and that violates the first and primary point of
>>having them.
>>
>>-- Scott
>>
>>
>>--
>>To unsubscribe from this list send an email to
>>users-unsubscribe at shibboleth.net
>
>--
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net