<div dir="ltr">Hi,<div><br></div><div>I have an IdP metadata in the federation. A new IdP with the same entityID was install. So the new IdP metadata has the same entityID, but different certificates, different SingleSignOnService locations.</div><div><br></div><div>Before I publish the new IdP metadata in the federation. I'd like to test it with one of the Service Providers. The SP shibboleth2.xml Metadata Provider config:</div><div><br></div><div><div><MetadataProvider type="Chaining" precedence="first"></div><div>    <MetadataProvider type="XML" validate="true" path="new-idp-metadata.xml"/></div><div>    <code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)"><</code><code class="gmail-xml gmail-keyword" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;font-weight:bold;color:rgb(51,102,153)">MetadataProvider</code><span style="color:rgb(51,51,51);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap"> </span><code class="gmail-xml gmail-color1" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(128,128,128)">type</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">=</code><code class="gmail-xml gmail-string" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">"XML"</code><span style="color:rgb(51,51,51);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap"> </span><code class="gmail-xml gmail-color1" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(128,128,128)">url</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">=</code><code class="gmail-xml gmail-string" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">"<a href="https://federation.org/metadata.xml" style="text-decoration-line:none;border-radius:0px;background:0px 50%;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;min-height:inherit;color:rgb(0,51,102)">https://federation.org/metadata.xml"</a></code><span style="color:rgb(51,51,51);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap"> </span><code class="gmail-xml gmail-color1" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(128,128,128)">backingFilePath</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">=</code><code class="gmail-xml gmail-string" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">"fedmetadata.xml"</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">/></code><br></div><div></MetadataProvider></div><div><br></div></div><div>This experiment seems to work. The new-idp-metadata.xml is taking effect with the above config. The old metadata in the federation is taking effect with the following config. </div><div><br></div><div><div><MetadataProvider type="Chaining" precedence="first"></div><div>    <code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)"><</code><code class="gmail-xml gmail-keyword" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;font-weight:bold;color:rgb(51,102,153)">MetadataProvider</code><span style="color:rgb(51,51,51);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap"> </span><code class="gmail-xml gmail-color1" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(128,128,128)">type</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">=</code><code class="gmail-xml gmail-string" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">"XML"</code><span style="color:rgb(51,51,51);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap"> </span><code class="gmail-xml gmail-color1" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(128,128,128)">url</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">=</code><code class="gmail-xml gmail-string" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">"<a href="https://federation.org/metadata.xml" style="color:rgb(0,51,102);text-decoration-line:none;border-radius:0px;background:0px 50%;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;min-height:inherit">https://federation.org/metadata.xml"</a></code><span style="color:rgb(51,51,51);font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;white-space:nowrap"> </span><code class="gmail-xml gmail-color1" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(128,128,128)">backingFilePath</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">=</code><code class="gmail-xml gmail-string" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">"fedmetadata.xml"</code><code class="gmail-xml gmail-plain" style="background-image:initial;background-position:0px 50%;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;border-radius:0px;border:0px;float:none;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,0,0)">/></code><br></div><div>    <MetadataProvider type="XML" validate="true" path="new-idp-metadata.xml"/></div><div></MetadataProvider></div></div><div><br></div><div><br></div><div>But I am confused by the warning in the document:</div><div><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider">https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPMetadataProvider</a><br></div><div><br></div><div><span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)">While there is some limited capability for controlling the handling of duplicate entities, it is explicitly </span><strong style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)">NOT</strong><span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)"> supported for a single </span><code style="color:rgb(51,51,51);font-size:14px;background-color:rgb(255,253,246)">entityID</code><span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)"> to appear more than once with the same valid role, and the software will </span><strong style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)">NOT</strong><span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)"> behave predictably in such a case. In other words, if the same entity supports a given role, its metadata </span><strong style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)">MUST</strong><span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)"> be identical in all chained sources.</span><br></div><div><span style="color:rgb(51,51,51);font-family:Arial,sans-serif;font-size:14px;background-color:rgb(255,253,246)"><br></span></div><div><br></div><div>Thank you very much.</div></div>