<div dir="ltr">Thanks for the feedback and advice so far, its been great. You guys have all touched on things that I've been concerned with as well. I'm hoping that I can keep our entityID as well, and I am scared of the ripples if we start changing our scoped values. We have the same plan where if the "public" sees the name, its in scope to be changed. <div>
<br></div><div style>Thanks again,</div><div style>Don</div><div class="gmail_extra"><br clear="all"><div><div dir="ltr">
<p><font face="georgia, serif">--------<br></font>Don W. Kidd<br>Senior Systems Analyst<br>dkidd@MiamiOH.edu<br><span style="font-family:georgia,serif;white-space:nowrap">513.529.9655</span></p><p><img src="https://mail.google.com/mail/u/1/?ui=2&ik=0eed6f3d8f&view=att&th=13c1f2a819e08956&attid=0.1&disp=thd&realattid=c5d5368e5200fe46_0.1&zw" alt="PastedGraphic-1.tiff"></p>
<p><font size="1" face="georgia, serif">“If your actions inspire others to dream more, learn more, do more and become more, you are a leader.” -- John Quincy Adams</font></p><p></p><br><p></p></div></div>
<br><br><div class="gmail_quote">On Wed, Jan 30, 2013 at 11:34 AM, Michael A Grady <span dir="ltr"><<a href="mailto:mgrady@unicon.net" target="_blank">mgrady@unicon.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="im"><br>
On Jan 30, 2013, at 10:30 AM, Michael A Grady wrote:<br>
<br>
> Illinois changed from "<a href="http://uiuc.edu" target="_blank">uiuc.edu</a>" to "<a href="http://illinois.edu" target="_blank">illinois.edu</a>" starting back about 2007. But retained both domains, and continue to forward email directed to an "@<a href="http://uiuc.edu" target="_blank">uiuc.edu</a>" address to the "@<a href="http://illinois.edu" target="_blank">illinois.edu</a>" address. And even given this was back before we had nearly the number of federated connections as there are today, or any campus-arranged cloud services, etc., Illinois has never changed its entityID from the original URN form with <a href="http://uiuc.edu" target="_blank">uiuc.edu</a> in it. It's just an internal name, the the usual reason for institutional domain name changes is Public Relations/"Institutional Identity". If the "public" sees the name, it is in scope to be changed, otherwise it can usually be left alone.<br>
><br>
</div>> This was a *big deal*, the campus payed PAID for a dedicated project manager to oversee all the different threads, activities, units, etc. that needed to be involved, and played out over several years. We did get permission to have our InCommon IdP entry list two allowed scopes to be asserted for some period of transition time - <a href="http://uiuc.edu" target="_blank">uiuc.edu</a> and <a href="http://illinois.edu" target="_blank">illinois.edu</a>.<br>
<div class="HOEnZb"><div class="h5">><br>
> The main campus page about that project can be found at:<br>
><br>
> <a href="http://illinoisdomainproject.illinois.edu/" target="_blank">http://illinoisdomainproject.illinois.edu/</a><br>
><br>
> There was, of course, much more internal documentation, project tracking pages, etc. Guidelines on how to handle the transition in server certificate names, etc.<br>
><br>
> Given the much greater complexity of federated connections, cloud services, etc. in play today, I sure wouldn't want to be involved in such a project today.<br>
><br>
> On Jan 30, 2013, at 9:40 AM, Cantor, Scott wrote:<br>
><br>
>> On 1/30/13 10:36 AM, "Peter Schober" <<a href="mailto:peter.schober@univie.ac.at">peter.schober@univie.ac.at</a>> wrote:<br>
>><br>
>>> * Tom Scavo <<a href="mailto:trscavo@gmail.com">trscavo@gmail.com</a>> [2013-01-30 16:27]:<br>
>>>> If you count the effect on users (that rely on cookies for discovery),<br>
>>>> the effect of a change to the IdP entityID is probably on par with the<br>
>>>> SP. We're approaching near zero tolerance for changing any entityID.<br>
>>>> Assurance is another area that is adversely affected by such a change.<br>
>>><br>
>>> Assuming the institution will still own/control the old domain I wouldn't<br>
>>> change the entityID and also keep the old scope around in metadata<br>
>>> (provided InCommon allows you to keep urn:mace:incommon:<a href="http://muohio.edu" target="_blank">muohio.edu</a>, no<br>
>>> idea what the rules are for that),<br>
>><br>
>> (To be clear, I wouldn't want to change it either, but if one is giving up<br>
>> control of a domain, they may not have a choice.)<br>
>><br>
>> But you raise a good point, scope is a much bigger deal. You'd end up<br>
>> breaking every application storing usernames. That's like a mass name<br>
>> change.<br>
>><br>
>> -- Scott<br>
>><br>
>><br>
>> --<br>
>> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
><br>
><br>
> --<br>
> Michael A. Grady<br>
> Senior IAM Consultant, Unicon, Inc.<br>
><br>
> --<br>
> To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
--<br>
Michael A. Grady<br>
Senior IAM Consultant, Unicon, Inc.<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>