<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As many are at this time, I am working on upgrading a very old instance of Shibboleth IdP v2 to IdP v3. I’m still fairly new with working with Shibboleth but I have IdP v3.2 installed on a new server with the same Entity ID and have copied
over the signing cert and key. I’ve tested with a few production SPs using the /etc/hosts file and everything works great. I’ve however run into problems with the InCommon Metadata and SPs. I’ve compared the Metadata of the our current IdP with the new one
and everything is the same except for the encryption and added signing certificates. When I try to logon on to any SP that used the InCommon Metadata I get a Tomcat 404 error. The reason is that the SP tried to redirect to /idp/profile/Shibboleth/Redirect/SSO.
From the metadata it seems that it should be /idp/profile/SAML2/Redirect/SSO. I wasn’t too sure why the current SPs were redirecting here until I was able to logon to the InCommon Admin page. It seems there the current bindings are defined for our IdP v2:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">/idp/profile/Shibboleth/SSO<o:p></o:p></p>
<p class="MsoNormal">/idp/profile/Shibboleth/SAML2/POST/SSO<o:p></o:p></p>
<p class="MsoNormal">/idp/profile/Shibboleth/Redirect/SSO<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The metadata was submitted before my time here, so I am unsure why this has remained like that other than it works. On the actual idp-metadata file of the v2 IdP, those bindings aren’t there. Of course if I were to change those bindings
to /idp/profile/SAML2/ it would break our current instance. My question is: Is there a way to add these bindings to the new IdP so that during cutover they work? I know I can change the bindings through the InCommon page and cutover, but I would be making
two big changes at once. I would rather first cutover to the new IdP, make sure everything works, and then change those bindings. If I change those bindings first, then the current IdP will break. Would a URL redirect be the best way to tackle this? Hope this
makes sense. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Regards,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">René Tapia <o:p></o:p></span></p>
</div>
</body>
</html>