Can I provision 2 Apache servers with the same <Extensions>?

Peter Schober peter.schober at univie.ac.at
Thu Mar 3 10:27:24 EST 2016


* Phil Ehrens <pehrens at ligo.caltech.edu> [2016-03-02 23:29]:
> Cantor, Scott wrote:
> > Well, I guess the point is, what does galaxy mean? Why does galaxy
> > have to change to something else? Shouldn't a new server just become
> > galaxy? That's the underlying point I'm making: you don't ever change
> > the names of things unless you want pain.
> 
> Since I'm upgrading from Apache 2.2 to 2.4, my Apache config
> needs to be refactored. I decided to do it piecemeal rather
> than exposing my users to the process and getting a thousand
> emails.

What about configuring and *testing* the replacement system as if it
were the existing system (keeping DNS entries, endpoints, TLS certs,
etc.)?

Temporarily you'd assign the new system a new IP address (in the same
VLAN/network/segment) and add the old host name to your hosts file of
your workstation/PC.:
https://en.wikipedia.org/wiki/Hosts_(file)
Then you will be able to access the new system using the old name, and
test it as desired, including logins from SAML IDPs (e.g. one of
LIGO's own). Firewall rules permitting you could also ask select
others to verify, telling them to make he same modification to their
hosts file and then log in to your SP using their institutional IDP.

Once you're satisfied that everything works (and thousands of emails
will be avoided), you remove your hosts file modifications (and ask
others to do the same) and move the IP address from the old system to
the new one. (If anything still breaks you can undo/redo the last step
as often as needed.)
Voila. No DNS changes, no web server changes, no SAML Metadata
changes, no firewall changes, no new endpoints, no new TLS cert to get
for the web server, etc.

You'll note that none of the above has anything to do with Shibboleth,
really.
-peter


More information about the users mailing list