add new IDP metadata with InCommon wizard?

[Losen, Stephen C. (scl)]

Hi Scott,

Ultimately I think I need 3 IDPs.  I need a development IDP to try out new releases and major departures from our current configuration.  I need a test IDP for adding new SPs, some of which are problematic and require trial-and-error tweaking of attribute filters, attribute resolver, and/or relying party.  Once the new SP works with the test IDP, I can migrate the configuration to the production IDP.

Currently our test IDP is known only to local SPs.  I agree with your point about not advertising our test IDP to the federation.  The correct approach is a local /etc/hosts file so that our test IDP uses our production entityID and metadata.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, July 25, 2016 2:56 PM
To: Shib Users
Subject: RE: add new IDP metadata with InCommon wizard?

> Some of our folks have test Shib SPs, which
> are configured to use the test IDP via the test entityID.  I'll need to talk to
> them about using the production entityID and local /etc/hosts instead.

If you really intend to run two IdPs for public consumption, then practically speaking they're both "public", and you would have to discuss it with InCommon. Discovery is one of the basic challenges with doing that.

If you have local systems you want to support, then you can publish your own metadata for that, you don't need InCommon to do it (I don't really recommend using InCommon to publish your metadata on campus anyway, that's only needed for SPs that are actually federated).

I don't personally believe in this model, I think systems need clear boundaries that preclude test -> test -> test flows end to end, because you're basically doubling your entire infrastructure and coupling everybody's testing together, and you end up needing a third IdP for development by you. But my own people argue with me about that endlessly, and they have settled on refusing to support test accounts in our IDM system, so it's a stalemate.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net