IdPv3 entityID & SAML 2.0 Questions

[Dave Perry]

FWIW we ran our old 2.x IdP on a VM, so I got a new VM with a clean install of the OS to do our v3 deployment. It sits on a different URL, but we registered it as a TEST IdP with the UK Federation and once we'd done all the testing we switched the old entityID into the v3 config (and the UK Federation doctored our metadata to have the new server URL using the old entityID) - so people's preferences and bookmarks in certain eResources were preserved.

Dave

_________________________________________________
Dave Perry
eLearning Technologist, Hull College Group

Room L34 - Queens Gardens Library
Wilberforce Drive, Queen's Gardens, Hull, HU1 3DG
Extension 2230 / Direct Dial 01482 381930

* Need a fast reply? Try elearning at hull-college.ac.uk *

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: 21 January 2016 16:39
To: Shib Users
Subject: RE: IdPv3 entityID & SAML 2.0 Questions

> I am new to shibboleth so I am slightly confused by this process. When 
> considering what needed to be done I thought a new server was the 
> better option.

A new server isn't the point, the issue is how you do the switch.

> We need to upgrade the OS as we are on RedHat 5 with our current IdP 
> and don't typically do in place upgrades for operating systems. We 
> would also prefer to upgrade the version of Tomcat that we are 
> running. If I must do an in place upgrade, how would I go about migrating to newer hardware?

How would you upgrade other software? You wouldn't change the location of your LDAP service, you'd test the new system and then change DNS to point to it.

Same thing here. The new system should be completely interchangeable with the old system, and can be tested using /etc/hosts *with the exception of the backchannel*. That's more a function of understanding the issues, what can break, and utimately taking the leap.

It is not tenable to do what you're doing. You cannot change an entityID or key without effectively starting from scratch, and your upgrade will take months. The SAML 2 migration is much more like that. You are effectively making a change that impacts, and may require changes by, other organizations. That can't be rushed. It's very different from a functionally equivalent swap to new software.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

**********************************************************************
This message is sent in confidence for the addressee
only. It may  contain confidential or sensitive
information.  The contents are not to be disclosed
to anyone other than the addressee.  Unauthorised
recipients are requested to preserve this
confidentiality and to advise us of any errors in
transmission.  Any views expressed in this message
are solely the views of the individual and do not
represent the views of the College.  Nothing in this
message should be construed as creating a contract.

Hull College Group owns the email infrastructure, including the contents.

Hull College Group is committed to sustainability, please reflect before printing this email.
**********************************************************************

TEXT