Environment Planning and Design Assistance

[Peter Schober]

* Adam Zheng <adam.zheng at esu10.org> [2016-08-01 18:12]:
> Or, would it be better to have multiple IdP's, one per school. This
> would end up with over 30 IdP's which sounds like a management
> nightmare.

You can both scale up (one big IDP) or out (one IDP per school), both
come with costs and complexity.

A few groups in the academic sector have started building automated
IDP installers + configuration management tools and/or hosted (or
managed) IDP services ("IDP as a Service").  Others have set up a
single IDP for a whole (small) country, connecting to institutions'
LDAP or RADIUS servers.
If you wanted to learn more about their approaches maybe join the
https://refeds.org/ group (cf. participation agreement).

Another example: In the (small) country I live the ministry of
education responsible for state-run schools has opted to sync all the
nation's pupils' data into a single directory server (and provide
distributed management capabilities to schools and other entitled
persons) and will put a single IDP in front of that.

But with all the config management and automated deployment/CI/CD
tooling available today running/managing dozens of instances shouldn't
be a big issue, today, whether those instances are hosted by the
institutions themselfs (with remote management from you other other
parties) or in your data center.

The complexity will likely not be in whatever you build, but what you
have to integrate with, i.e., the mess that is institutional data
stores and local practices. So some standardization (i.e., investment
in shared technology, processes, schema, etc.) will probably be needed
in order to keep costs/complexity low going forward, whether within
the institutions, or using the metadirectory mentioned, or using the
centralized directory approach. That will make both managing 30 simple
IDPs or one very complex one much easier.
-peter