4x upgrade planing

[Christopher Bongaarts]

On 9/14/2020 4:21 PM, Donald Lohr wrote:
> We started out with Shib IdP v1.3, moved into the 2.x arena and are 
> now in the 3.x arena.  Past admins and internal emails and 
> documentation speak to a "compatibility mode" /thingy/ that our IdP is 
> currently configured with. But I can not find anything that describes 
> that.
>
> I did find the following:
> https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration#AttributeResolverConfiguration-V2Compatibility
>
> /The next major version of the IdP will remove this guarantee, and 
> indeed V2 configuration will //*not*//work unchanged in V4. It is an 
> aim (but not a guarantee) that any configuration which loads without 
> warning in IdP 3.4 will load in V4. See //this page 
> <https://wiki.shibboleth.net/confluence/display/IDP30/DeprecatedIdPV4>//for 
> details./
>
> But I do not know for certain if this is what our past admins were 
> referring to. If this is what they meant, how would I find what 
> controls / determines this in the configuration of my IdP?

We too went 1.3 -> 2.x -> 3.x and are working on our 4.x upgrade now.

The main compatbility "mode" feature I can think of is the Legacy NameID 
generators; based on the setting in saml-nameid.properties, it will 
either use the 2.x NameID generation (AttributeEncoders in the attribute 
resolver, with the attribute filter controlling which is actually used) 
or the 3.x+ NameID generation (beans in the saml-nameid.xml file 
released based on SP request, metadata, and defaults).  The 
NameIDGeneration topic in the 3.0 IDP wiki describes how the new 
selection works.

There are also changes to the relying-party file, which are controlled 
by settings in services.properties.

In general, you can walk down the list of topics in the 3.0 wiki under 
Configuration and look for the "V2 compatilbility" notes on each page.

We are taking the approach of upgrading our 3.3.0 IdP to 3.4.7 first, in 
order to get the maximum deprecation warnings, then fixing those 
warnings (and other changes indicated by release notes) prior to 
upgrading to 4.x.  So far this is going well, but we are just wrapping 
up our development environment, and test will introduce a few more 
interesting cases.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200914/69bdf4cd/attachment.htm>