Migrate IdP to new domain

[Ash]

We’re being required to migrate our IdP from our current domain to a new one (e.g. example.org to example.net). The domain is also used by our external access manager, to which the IdP delegates authentication via RemoteUser, and which will be migrated at the same time.

Some SPs that use our IdP will have to make manual configuration updates since they don’t leverage our metadata, and they won’t all be able to cut over in a short maintenance window. We need to support all SPs during a transition that may take a few weeks.

Is SAML authentication (IdP proxy) the recommended way to handle this?

Is there an alternative using multiple SingleSignOnService elements in the IdP metadata, with the same Binding but different Location values? For example,

<SingleSignOnService
Binding=“urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect”
Location=“https://www.example.org/idp/profile/SAML2/Redirect/SSO”/>

and

<SingleSignOnService
Binding=“urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect” Location=“https://www.example.net/idp/profile/SAML2/Redirect/SSO”/>

Or possibly some other recommendation?

Thanks
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220303/5d3b48f2/attachment.htm>