v2->v3 upgrade, idp-metadata.xml

[Baron Fujimoto]

I'm making progress on our v2->v3 upgrade. I've completed the post-upgrade
tasks for metadata-providers.xml and relying-party.xml, though I've yet to
convert them to new the new configuration style.

I'm able to successfully load the status servlet both via a browser and
using the status script. The AllowedIPs parameter wasn't automatically
carried over from the Status servlet in the v2.conf/web.xml into its
equivalent in v3's access-control.xml's allowedRanges. Perhaps this might
be noted as a post-upgrade task as well?

aacli also appears to generate the expected results.

Before moving on to configuring an external CAS authentication (we'll
get around to transitioning to the native CAS later), I wanted to
verify the upgrade with testshib.org. I'm running into problems with
our metadata though. Testshib rejects it as invalid. 

This is presumably the result of the way I pursued this upgrade, where I
copied an existing deployment to a new host and upgraded that. This meant
I had the metadata from the original host. I edited the copied metadata
to reflect the new hostname in the SSO endpoints. I also took the
opportunity to follow recommendations to use the same entityID in our
test and production environments, and thus updated the entityID as well.
Testshib is not specific as to why the metadata is invalid, but I'm
supposing it may be due to a mismatch in the x509 certificates? If this
is probably it, what's the best way to correct this or regenerate the
metadata (and /credentials ?) for the new host?

-- 
Baron Fujimoto <baron at hawaii.edu> :: UH Information Technology Services
minutas cantorum, minutas balorum, minutas carboratum desendus pantorum