Successful IDPv2 to v3 Migration

[Peter Schober]

* McKean, Brandon Scott - mckeanbs <mckeanbs at jmu.edu> [2015-07-20 14:47]:
> The main gotcha encountered during the actual cutover was needing to
> support SOAP endpoints as is documented on the Jetty9 page. The
> configuration didn't work for us out of the box because of port 8443
> conflicting with what we had setup (as was hinted on the
> SecurityAndNetworking page), so I changed it to use 8009 and made an
> iptables rule redirect port 8443 to 8009.

What is conflicting with that? If you set up and expose to the outside
world (via SAML metadata) an attribute authority on port 8443 you'll
also configure the container with the SAML trust fabric to listen
there (and nothing else).
If you reroute (on the kernel level) external traffic to some other
port, what process is listening on port 8443 then?

> I also had to make a new pkcs12 keystore for the original idp.crt
> and idp.key files we had so that it would match what the metadata
> published.

Does that mean you did a fresh install on a new box?

> In any case, with all that done, it was just a matter of getting
> attribute-filter right with various SPs.

Same here: You did not try to re-use the existing attribute filter
polcies? Or you tried and they didn't work?
-peter