Upgrading IDP by Changing SingleSignOnService Locations and Certificates at the Same Time

[Tom Scavo]

On Tue, Dec 19, 2017 at 2:52 PM, Albert Luo <albert.uwin at gmail.com> wrote:
> We have two IDPs, IDP A and IDP B.
>
> IDP A is an older version of Shibboleth IDP. IDP A's metadata is
> currently in the federation aggregates. We plan to replace IDP A's
> metadata with IDP B's  metadata and retire IDP A from service.
>
> IDP A and IDP B have  the same entityID, same organization name.

>From where you sit, yes, there are two IdPs, but your partners won't
see it that way since the entityID is not changing. (The organization
name has no operational significance.)

> IDP A and IDP B metadata have different sets of signing/encryption
> certificates, and different sets of SingleSignOnService Locations.

Let's focus on the endpoints for a moment. AFAIK there is no way to
seamlessly migrate to a new set of endpoints using a single IdP
instance. You have to keep both sets of endpoints in operation for a
time. That is, you need to run two IdPs, each with the same entityID.

> Our plan is to provide IDP B's metadata to the federation to replace
> IDP A's metadata.

Right, I think I understand what you mean, but to be clear, your
metadata is not being replaced, the endpoints are being changed (which
is often a breaking change).

> The IDP B's metadata will eventually propagate to
> the SPs. When a SP pick up the  IDP B's metadata, the SP will start
> redirecting logins to the IDP B's SingleSignOnService Locations, and
> will use IDP B's certificate for SAML exchanges.

I think of it in terms of "old metadata" and "new metadata," but yes,
you will have two entity descriptors in play for some period of time.

> In this scenario,  we will not need certificate roll over. Assuming
> IDP B is configured correctly, SPs will switch to IDP B peacefully.

I think that's right but then the two IdPs are not identically configured.

> Is my understanding of the migration process correct? Do you see any
> problem with this plan? Has anybody migrate/upgrade IDP this way?

I know of at least one campus that has done this successfully, yes.

Tom