Shibboleth SP migration plan

[Cantor, Scott]

> We're migrating several instances of Shibboleth SP and their respective
> sites to a new data centre, and the following is our plan for migrating the
> SPs. We're really hoping to avoid any re-integration with the IdPs - some
> clients' IdPs only do quarterly updates, plus if they see this as a new
> integration there could be a non-trivial cost involved.

I hope they're under no illusions that that's a secure way to operate.

> For testing, I'm hoping I can just edit a local hosts file on a test
> machine, to point the site/SP domain names to the new datacentre
> addresses.
> >From what I've read, the IdP doesn't normally communicate directly with
> the SP (is that for Artefact binding? - which we don't use), so hopefully that
> let's us test the new setup in advance of the DNS changeover.

Yes, it does. What Peter was talking about is if you move an IdP. The only direct connection from IdP to SP is artifact binding or backchannel logout, neither of which any Shibboleth IDP version supports at this time.

-- Scott