IdPv3 entityID & SAML 2.0 Questions

[Cantor, Scott]

> I am new to shibboleth so I am slightly confused by this process. When
> considering what needed to be done I thought a new server was the better
> option.

A new server isn't the point, the issue is how you do the switch.

> We need to upgrade the OS as we are on RedHat 5 with our current
> IdP and don't typically do in place upgrades for operating systems. We would
> also prefer to upgrade the version of Tomcat that we are running. If I must
> do an in place upgrade, how would I go about migrating to newer hardware?

How would you upgrade other software? You wouldn't change the location of your LDAP service, you'd test the new system and then change DNS to point to it.

Same thing here. The new system should be completely interchangeable with the old system, and can be tested using /etc/hosts *with the exception of the backchannel*. That's more a function of understanding the issues, what can break, and utimately taking the leap.

It is not tenable to do what you're doing. You cannot change an entityID or key without effectively starting from scratch, and your upgrade will take months. The SAML 2 migration is much more like that. You are effectively making a change that impacts, and may require changes by, other organizations. That can't be rushed. It's very different from a functionally equivalent swap to new software.

-- Scott