SP Migration to New Server

[Brett Melling]

Hi Peter,
That won't work in our case as we've abstracted Shibboleth from the
applications (we have a single Shibboleth service for multiple distributed
application, and a bespoke application running on the Shibboleth system to
interface between Shibboleth and our SSO enabled application instances). So
the user connects to the web application and it's the application that is
programmed with where to find the Shibboleth system. We did try using the
hosts file on a test application server to point to new Shibboleth system
but it didn't work.

I don't recall the error but I didn't persist with it as I was sure - given
all the 'traffic' taking place in an SSO exchange - that DNS would be used
for more than the 'first hop'. But your answer suggests not (i.e. your
answer suggests you would expect there to be no further lookup of CNAME
sp.ourdomain.com at any other stage in the SSO process such as between SP
and IdP etc) which would be a very helpful thing to find out if so. And we'd
perhaps revisit the same test we did based on amending hosts files in our
test application system and looking at the failure with a little more
scrutiny.

Kind Regards,

Brett Melling



Website: https://calpendo.com 
LinkedIn: http://www.linkedin.com/in/calpendo |
https://www.linkedin.com/company/exprodosoftware/
General enquiries - info at exprodo.com 
Technical enquiries - support at exprodo.com

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober via
users
Sent: Monday, July 1, 2024 1:06 PM
To: users at shibboleth.net
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: SP Migration to New Server

Brett Melling <brett.melling at exprodo.com> [2024-07-01 13:54 CEST]:
> The existing server (e.g. server1.ourdomain.com) has worked well for a 
> number of years by way of a CNAME pointing to it - sp.ourdomain.com - 
> that is referenced in our metadata, and we are ready to migrate 
> Shibboleth functionality to new server server2.ourdomain.com which is 
> configured and believed to be ready from testing of server2.ourdomain.com
in isolation.
> 
> Does anyone know of a reliable way of testing the Shibboleth 
> functionality of server2 from a customer perspective before we update 
> the DNS CNAME sp.ourdomain.com from server1 to server2, given the 
> nature of DNS and how long it might take for a reversal to propagate 
> again should there be any issues?

Simply add the new IP address for the existing, published host name to your
local PC's hosts file, https://en.wikipedia.org/wiki/Hosts_(file)
thereby overriding DNS for that machine.

Accessing the published host will then take you to the new instance but only
on the machine with the changed hosts file.

-peter
--
For Consortium Member technical support, see
https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net