Shibboleth SP migration plan

[MikeWho]

Hi all,

We're migrating several instances of Shibboleth SP and their respective
sites to a new data centre, and the following is our plan for migrating the
SPs. We're really hoping to avoid any re-integration with the IdPs - some
clients' IdPs only do quarterly updates, plus if they see this as a new
integration there could be a non-trivial cost involved.

- Install Shibboleth SP (planning on staying on 2.5.3 to minimise change
risk, not sure if v3 is a better choice. Installing on IIS8 on Windows
Server 2012, I've only previously installed on IIS6 so there may be some
issues there.)
- Copy shibboleth2.xml from current instance (updating site IDs in InProcess
section is the only required change I'm aware of).
- Copy sp-key.pem and sp-cert.pem from current instance (this I'm not sure
about. Can these files - generated with keygen.bat - just be transferred
from one server to another? If we need to regenerate these, it means a
re-integration with the IdPs)
- Copy attribute map files, IdP metadata files, and edited html templates
(we've changed nothing else) from current instances.

Then update the DNS entries for the sites to point to the new data-centre
addresses and that should be it. Does this look ok? Anything obvious I'm
missing?

For testing, I'm hoping I can just edit a local hosts file on a test
machine, to point the site/SP domain names to the new datacentre addresses.
>From what I've read, the IdP doesn't normally communicate directly with the
SP (is that for Artefact binding? - which we don't use), so hopefully that
let's us test the new setup in advance of the DNS changeover.

Many thanks again for any help or advice!!
Mike.



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-migration-plan-tp7611070.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.