Can I provision 2 Apache servers with the same <Extensions>?

[Phil Ehrens]

Cantor, Scott wrote:
> On 3/2/16, 4:20 PM, "users on behalf of Phil Ehrens" <users-bounces at shibboleth.net on behalf of pehrens at ligo.caltech.edu> wrote:
>  
> >
> >The ligo-metadata.xml for galaxy looks like this:
> 
> Well, I guess the point is, what does galaxy mean? Why does galaxy
> have to change to something else? Shouldn't a new server just become
> galaxy? That's the underlying point I'm making: you don't ever change
> the names of things unless you want pain.

Since I'm upgrading from Apache 2.2 to 2.4, my Apache config
needs to be refactored. I decided to do it piecemeal rather
than exposing my users to the process and getting a thousand
emails.
 
> That said, SAML metadata indirects at least everything *but* the
> entityID, which you simply CANNOT change unless you want life to
> be bad for everybody, or unless the only IdP consuming it is yours
> (in which case, most of SAML becomes academic to some degree).

> >I'm afraid I don't understand the significance of any of these
> >declarations.
> 
> Well, you really need to start with a read up on SAML metadata to
> understand what it's all being used for, but to answer the question,
> endpoints don't have to be unique in metadata. Multiple systems with
> different entityIDs can have the same endpoints in them. The validation
> is by whether an endpoint is valid for an entity, not to derive an
> entity's identity by a location.

Ah, thank you! That was the bit I couldn't seem to get, that the
endpoint is not defined by it's location.

And yes, I have to convince myself that SAML metadata is warm and
fuzzy in spite of being XML. Unfortunately (or fortunately) I only
have to mess with it at multi-year intervals, so not much has a
chance to stick.

> > The Apache virtual hosts use A records, not CNAMES.
> 
> I'm not sure why that would matter.

The DNS doesn't need to be changed with A records. CNAMES
are unfortunately endpoints that are only valid when
coupled with a location ;^)

Anyway, thank you again for solving my problem! 

Phil
-- 
Phil Ehrens <phil.ehrens at ligo.org> |              mm
The LIGO Laboratory, MS 100-36     |           /^(  )^\
California Institute of Technology |           \,(..),/
1200 East California Blvd.         |             V~~V
Pasadena, CA 91125 USA             | My gpg public key:
Phone:(626)395-8518                | http://www.imbe.net/peligo.asc