"override" of InC SP metadata?

[Nate Klingenstein]

David,

So far as I'm aware, it's first match wins.  If you write replacement metadata and place an XML MetadataProvider prior to the InCommon metadata provider that you're using, it should pick it up preferentially.

Take care,
Nate.

 
 
-----Original message-----
> From: IAM David Bantz
> Sent: Friday, June 14 2019, 8:22 pm
> To: Shib Users
> Subject: "override" of InC SP metadata?
> 
> 
> 
> Is it possible to "override" ACS end point n SPs  InC metadata?
> 
> Heres the reason/background: Zoom configured a test domain for us and added the SP metadata to InCommon. Everything worked. Then they went to migrate us to production and broke it; the production domain is routing the request to our IdP with the test entityID, which might be sort of OK, but the request indicates a return point in the prod domain and that end point isnt in the metadata. They turned off SSO in the test domain, so were now not able to log in to either the previously successful test instance or the production instance. Alas, this is a very high level high visibility short time-line deployment for us, so I wondered, in the absence of reasonable action from zoom I could "override"or just add the  end point or replace the entire SP metadata with local version based on what the zoom integration site claims to be the metadata for our production domain. [both instances contain the same encryption cert, alas a 2-year cert].
> 
> David Bantz
> 
> UA OIT IAM
> 
> Previously working "test" SP metadata in InC aggregate:
> 
> <EntityDescriptor entityID="https://testalaska.zoom.us <https://testalaska.zoom.us>">
> 
> ...
> 
> <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://testalaska.zoom.us/saml/SSO <https://testalaska.zoom.us/saml/SSO>" index="1"/>
> 
> Zoom-asserted metadata SP metadata for production:
> 
> <md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" entityID="https://testalaska.zoom.us <https://testalaska.zoom.us>">
> 
> ...
> 
> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://alaska.zoom.us/saml/SSO <https://alaska.zoom.us/saml/SSO>" index="0" isDefault="true"/>
> 
> <md:AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://alaska.zoom.us/saml/SSO <https://alaska.zoom.us/saml/SSO>" index="1"/>
> 
> --
> 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
>