Shibboleth SP migration plan

[Tom Scavo]

On Thu, Jan 22, 2015 at 12:31 PM, Peter Schober
<peter.schober at univie.ac.at> wrote:
>
> Yes, modifying your local resolver is a great way to test both SAML
> IDPs and SAML SPs, provided the backchannel can be avoided (it usually
> can).
> That's even better than having seperate test system with a seperate
> hostname and different keys and configuration etc., as you can test with
> production IDPs just the same, whereas with a seperate test IDP not
> all IDPs would know that or send it attributes.
> (Even more so for IDPs: With a seperate test IDP going by another
> entityID and endpoint URLs you can't test most production SPs, as they
> wouldn't know about the test IDP, or wouldn't have it mapped to the
> same customer/contract/institution as your prod one.)
> Always assuming the test system (which you access via your manipulated
> resolver) has access to and is configured with the prod system keys
> and configuration.

BIG +1

> Took me far too long to think about doing that.

Me, too! :-)

Tom