IdPv3 entityID & SAML 2.0 Questions

[Andrew Morgan]

On Thu, 21 Jan 2016, Cantor, Scott wrote:

>> Would it be best to start by installing IdPv2 on the new server or can I just
>> copy to contents of "/opt/shibboleth-idp" from my current IdP server?
>
> Doesn't really matter that much.
>
> Whether you start "clean" or by upgrading is one of those personal 
> questions. I think it's easier to upgrade, test, and gradually modernize 
> settings than to try and recreate everything from scratch to match. I 
> think the latter is very dependent on having a very thorough record and 
> grasp of everything the old system was doing or you'll miss something.

I'll second this.  When we were getting ready to upgrade from IDPv2 to 
IDPv3, I first spent a few weeks upgrading all the infrastructure (OS, 
Java, Tomcat).  Then we upgraded the IDP.  Finally, we converted to the 
new configuration file format.  We have a 2-node cluster.  After each 
step, we would test the changes by editing /etc/hosts before putting the 
node back into production.

We still ran into one broken SP (a bug in their software) because it 
wasn't possible to test everything.  Overall though, the upgrades were 
invisible to our users.

 	Andy