SP Migration to New Server

[Timothy Spear]

Normally SAML is all bouncing through the client machine.
So setting the host file on the client machine would be all that is
required.

If you are doing additional steps (such as a call back to the IdP from your
application server for some special reason); you might need to alter the
host file of your application server to point to the sp2 instance.

Tim

On Mon, Jul 1, 2024 at 1:51 PM Brett Melling <brett.melling at exprodo.com>
wrote:

> Hi Peter,
> That won't work in our case as we've abstracted Shibboleth from the
> applications (we have a single Shibboleth service for multiple distributed
> application, and a bespoke application running on the Shibboleth system to
> interface between Shibboleth and our SSO enabled application instances). So
> the user connects to the web application and it's the application that is
> programmed with where to find the Shibboleth system. We did try using the
> hosts file on a test application server to point to new Shibboleth system
> but it didn't work.
>
> I don't recall the error but I didn't persist with it as I was sure - given
> all the 'traffic' taking place in an SSO exchange - that DNS would be used
> for more than the 'first hop'. But your answer suggests not (i.e. your
> answer suggests you would expect there to be no further lookup of CNAME
> sp.ourdomain.com at any other stage in the SSO process such as between SP
> and IdP etc) which would be a very helpful thing to find out if so. And
> we'd
> perhaps revisit the same test we did based on amending hosts files in our
> test application system and looking at the failure with a little more
> scrutiny.
>
> Kind Regards,
>
> Brett Melling
>
>
>
> Website: https://calpendo.com
> LinkedIn: http://www.linkedin.com/in/calpendo |
> https://www.linkedin.com/company/exprodosoftware/
> General enquiries - info at exprodo.com
> Technical enquiries - support at exprodo.com
>
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Peter Schober via
> users
> Sent: Monday, July 1, 2024 1:06 PM
> To: users at shibboleth.net
> Cc: Peter Schober <peter.schober at univie.ac.at>
> Subject: Re: SP Migration to New Server
>
> Brett Melling <brett.melling at exprodo.com> [2024-07-01 13:54 CEST]:
> > The existing server (e.g. server1.ourdomain.com) has worked well for a
> > number of years by way of a CNAME pointing to it - sp.ourdomain.com -
> > that is referenced in our metadata, and we are ready to migrate
> > Shibboleth functionality to new server server2.ourdomain.com which is
> > configured and believed to be ready from testing of
> server2.ourdomain.com
> in isolation.
> >
> > Does anyone know of a reliable way of testing the Shibboleth
> > functionality of server2 from a customer perspective before we update
> > the DNS CNAME sp.ourdomain.com from server1 to server2, given the
> > nature of DNS and how long it might take for a reversal to propagate
> > again should there be any issues?
>
> Simply add the new IP address for the existing, published host name to your
> local PC's hosts file, https://en.wikipedia.org/wiki/Hosts_(file)
> thereby overriding DNS for that machine.
>
> Accessing the published host will then take you to the new instance but
> only
> on the machine with the changed hosts file.
>
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240701/f8771307/attachment.htm>