Shibboleth SP migration plan

[MikeWho]

Peter Schober wrote
> There is no SPv3, jfyi. You're confusing this with the all new IDPv3.

Aha! Was wondering why I couldn't find the installer. That removes one
decision.


> Yes, you will need to copy those over, too! Lacking those your SP will
> fail to decrypt any encrypted SAML assertions, and yes, you'd have to
> redistribute changed metadata (or the changed public key) to all IDPs
> and/or federations. Not something you'd do unless you conciously chose
> to do that for sensible reasons.

Good to know, thanks. I was worried they might be tied somehow to the server
on which they were generated.


> If you're OK with some still connecting to the old site, and some to
> the new site (and any inconsistencies that may arise from changing
> data at two different sites), then yes.
> DNS changes may take time to progagate and even if you set the TTL
> very low well in advance some sites may cache old records longer than
> they should. Those would keep sending requests to the old IP address.

The DNS update is likely to be late Friday/early Saturday so we have two
days with minimal traffic while the change propagates, should be long
enough, I hope.


> Attribute Queries would also happen between the IDP and SP directly.
> If you have SAML1 only IDPs that do not push attributes unencrypted
> over the browser (which is a choice they could make) you'll have to
> deal with those, too.
> And the DNS resolver for the back-channel communication (i.e., at the
> IDP) may not be in sync with the DNS resolver the subject uses,
> meaning SSO will go to one site (old, or new) and attribute queries
> may go to the other (new, or old).
> 
> Moving the IP address over would avoid that, but depending on the
> address type that's not commonly possible.

All the IdPs support SAML2, and we only use front-channel communications, so
we're ok there. And all the attributes we need are contained in the initial
SAML response so there are no additional attribute queries. It sounds like
that should work so, thanks a lot Peter (for this and your other post)! 

Mike.

 



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/Shibboleth-SP-migration-plan-tp7611070p7611074.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.