IdP v3 Relying Party Configuration

[Cantor, Scott]

> FWIW, the OP's approach (build a new IDPv3 and migrate relevant
> settings over from IDPv2) is also what most deployers here have asked
> about.

I know. The reason I keep harping on it is that it's not working, which isn't surprising given that it wasn't the intended method.

People are breaking SPs, and the ones they break are the ones they don't have tight connections to, namely the R&S cases where it's all ad hoc. And those are the SPs that we really care about as a community and that we got into this to help, and they're paying the price for this choice.

This same thing happened with V1 to V2, but that was not deployed at the same scale we have now, wasn't SAML 2 and had fewer options to break, and it was our fault since we gave people no way to upgrade those settings cleanly.

-- Scott