Shibboleth IdP V3 /Shibboleth/Redirect

[Tapia, Rene]

Hello,

As many are at this time, I am working on upgrading a very old instance of Shibboleth IdP v2 to IdP v3. I'm still fairly new with working with Shibboleth but I have IdP v3.2 installed on a new server with the same Entity ID and have copied over the signing cert and key. I've tested with a few production SPs using the /etc/hosts file and everything works great. I've however run into problems with the InCommon Metadata and SPs. I've compared the Metadata of the our current IdP with the new one and everything is the same except for the encryption and added signing certificates. When I try to logon on to any SP that used the InCommon Metadata I get a Tomcat 404 error. The reason is that the SP tried to redirect to /idp/profile/Shibboleth/Redirect/SSO. From the metadata it seems that it should be /idp/profile/SAML2/Redirect/SSO. I wasn't too sure why the current SPs were redirecting here until I was able to logon to the InCommon Admin page. It seems there the current bindings are defined for our IdP v2:

/idp/profile/Shibboleth/SSO
/idp/profile/Shibboleth/SAML2/POST/SSO
/idp/profile/Shibboleth/Redirect/SSO

The metadata was submitted before my time here, so I am unsure why this has remained like that other than it works. On the actual idp-metadata file of the v2 IdP, those bindings aren't there.  Of course if I were to change those bindings to /idp/profile/SAML2/ it would break our current instance. My question is: Is there a way to add these bindings to the new IdP so that during cutover they work? I know I can change the bindings  through the InCommon page and cutover, but I would be making two big changes at once. I would rather first cutover to the new IdP, make sure everything works, and then change those bindings. If I change those bindings first, then the current IdP will break. Would a URL redirect be the best way to tackle this? Hope this makes sense.

Regards,
René Tapia
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160121/35cad1f9/attachment-0001.html>