<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 9/14/2020 4:21 PM, Donald Lohr
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:7c4d5c20-389a-c07c-dc56-bb97fbcc86e5@jmu.edu">We started
out with Shib IdP v1.3, moved into the 2.x arena and are now in
the 3.x arena. Past admins and internal emails and documentation
speak to a "compatibility mode" <i>thingy</i> that our IdP is
currently configured with. But I can not find anything that
describes that.<br>
<br>
I did find the following:<br>
<tt><a class="moz-txt-link-freetext"
href="https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration#AttributeResolverConfiguration-V2Compatibility"
moz-do-not-send="true">https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolverConfiguration#AttributeResolverConfiguration-V2Compatibility</a></tt><br>
<br>
<i>The next major version of the IdP will remove this guarantee,
and indeed V2 configuration will </i><i><strong>not</strong></i><i>
work unchanged in V4. It is an aim (but not a guarantee) that
any configuration which loads without warning in IdP 3.4 will
load in V4. See </i><i><a
href="https://wiki.shibboleth.net/confluence/display/IDP30/DeprecatedIdPV4"
moz-do-not-send="true">this page</a></i><i> for details.</i><br>
<br>
But I do not know for certain if this is what our past admins were
referring to. If this is what they meant, how would I find what
controls / determines this in the configuration of my IdP?<br>
</blockquote>
<p>We too went 1.3 -> 2.x -> 3.x and are working on our 4.x
upgrade now.</p>
<p>The main compatbility "mode" feature I can think of is the Legacy
NameID generators; based on the setting in saml-nameid.properties,
it will either use the 2.x NameID generation (AttributeEncoders in
the attribute resolver, with the attribute filter controlling
which is actually used) or the 3.x+ NameID generation (beans in
the saml-nameid.xml file released based on SP request, metadata,
and defaults). The NameIDGeneration topic in the 3.0 IDP wiki
describes how the new selection works.</p>
<p>There are also changes to the relying-party file, which are
controlled by settings in services.properties.</p>
<p>In general, you can walk down the list of topics in the 3.0 wiki
under Configuration and look for the "V2 compatilbility" notes on
each page.</p>
<p>We are taking the approach of upgrading our 3.3.0 IdP to 3.4.7
first, in order to get the maximum deprecation warnings, then
fixing those warnings (and other changes indicated by release
notes) prior to upgrading to 4.x. So far this is going well, but
we are just wrapping up our development environment, and test will
introduce a few more interesting cases.<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>