Migrate IdP to new domain

[Cantor, Scott]

The only solution to this is proper support for metadata, as it is in OIDC. Because the rest of the SAML world decided not to bother supporting metadata properly, Shibboleth and a few of its open source cousins are the only ones that handle it.

But just adding endpoints to metadata does not work, it couldn't. If you don't see why, think about it some more. You're also presupposing they support metadata to start with, the lack of which is the whole reason you have the problem.

If you're not changing the entityID, which you shoudn't, then one way to at least paper over it somewhat is relaying requests. That's not exactly proxying, just rewriting/reissuing requests from the original URL into a new SAML request to the new URL.

Otherwise, the only option is proxying or just running both for, essentially, months while you transition (which in effect is also what proxying means).

-- Scott