How-to build a custom federation

[Peter Schober]

* romain.dauby at orange.com <romain.dauby at orange.com> [2015-09-17 10:32]:
> The two IDP are using the same LDAP and retrieve the same attributes
> (attribute-resolver.xml).

OK, but that doesn't change anything wrt the exchange of metadata.

> We have these two to migrate applications (with SP) from IDP v2 to v3.

A.k.a. you brought the complexity of more than 1 IDP upon yourself.

An alternative would have been to make copy of the old prod IDP,
assign it a different IP address and access it from your workstation
via a tuned DNS resolver config (/etc/hosts or equivalent).
That should allow you to use the cloned instance with all the existing
SPs, without involving them.
Then update the cloned IDP to v3 according to the v2-to-v3 update docs
and test, configure, test until it works as desired.
Finally, replace the prod IDP with the clone. Always keeping the
entityID, so not needing to involve SPs.
-peter