Can I provision 2 Apache servers with the same <Extensions>?

[Phil Ehrens]

Hi Peter,

Thank you for your input.

Scott Cantor's suggestion of using a logical EntityID
pretty much solves all my issues, without having to
monkey with DNS, endpoints, certs, etc.

All remaining configuring and testing has to do with
the OS and Apache upgrade.

Phil

Peter Schober wrote:
> * Phil Ehrens <pehrens at ligo.caltech.edu> [2016-03-02 23:29]:
> > Cantor, Scott wrote:
> > > Well, I guess the point is, what does galaxy mean? Why does galaxy
> > > have to change to something else? Shouldn't a new server just become
> > > galaxy? That's the underlying point I'm making: you don't ever change
> > > the names of things unless you want pain.
> > 
> > Since I'm upgrading from Apache 2.2 to 2.4, my Apache config
> > needs to be refactored. I decided to do it piecemeal rather
> > than exposing my users to the process and getting a thousand
> > emails.
> 
> What about configuring and *testing* the replacement system as if it
> were the existing system (keeping DNS entries, endpoints, TLS certs,
> etc.)?
> 
> Temporarily you'd assign the new system a new IP address (in the same
> VLAN/network/segment) and add the old host name to your hosts file of
> your workstation/PC.:
> https://en.wikipedia.org/wiki/Hosts_(file)
> Then you will be able to access the new system using the old name, and
> test it as desired, including logins from SAML IDPs (e.g. one of
> LIGO's own). Firewall rules permitting you could also ask select
> others to verify, telling them to make he same modification to their
> hosts file and then log in to your SP using their institutional IDP.
> 
> Once you're satisfied that everything works (and thousands of emails
> will be avoided), you remove your hosts file modifications (and ask
> others to do the same) and move the IP address from the old system to
> the new one. (If anything still breaks you can undo/redo the last step
> as often as needed.)
> Voila. No DNS changes, no web server changes, no SAML Metadata
> changes, no firewall changes, no new endpoints, no new TLS cert to get
> for the web server, etc.
> 
> You'll note that none of the above has anything to do with Shibboleth,
> really.
> -peter
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Phil Ehrens <phil.ehrens at ligo.org> |              mm
The LIGO Laboratory, MS 100-36     |           /^(  )^\
California Institute of Technology |           \,(..),/
1200 East California Blvd.         |             V~~V
Pasadena, CA 91125 USA             | My gpg public key:
Phone:(626)395-8518                | http://www.imbe.net/peligo.asc