Shib IdP v3: Which certificate do you upload to InCommon?

[Nate Klingenstein]

If all your SP partners fully participated in some federation (like InCommon), you wouldn't have had to send 100s of email messages to coordinate your upgrade to Shib IdP V3.

I’m wary of pushing the “all in 1” concept too far.  The logical extension of that is if InCommon is managing all your identity provider’s connections, then why not pitch it all over the fence?

My “why not” is that I’ve seen enough big shifts in strategy and deployment paradigms to be somewhat paranoid about putting all my eggs in a basket I have virtually no control over.

I don’t think there’s a risk of deliberate failure so much as gradual change in priorities, commercial incentives, and functionality matrixed against the indefatigable force known as laziness.  It’s a natural crevice for technical debt to accrete in.

The major question I try to ask is, “if I were completely leveraging your model today and I wanted to switch to ‘something’ else, how awful would my life be?”

Initial responses indicate that the question isn’t asked nearly as frequently as organizations find themselves answering it.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160315/34bcf994/attachment.html>