State Management and Clustering (IdP)

[Peter Williams]

One needs to thing less enterprisy, and more webby. 

Replicating membership data sets around comes easy in webby thinking. It's a sideeffect of the release of authentication statements with attributes, or because the SP can now invoke OAUTH-guarded API calls on the Attribute Authority - whose endpoints are armed as a result of the assertion process. 

The whole OAUTH thing of course reminds one of the long-discarded/underused AttributeQuery of the SAML world...and even the AssertionQuery to go get stored tokens from a store. Obviously, the OAUTH thing is conceptually simple, which may explain its adoption.

If one looks at the Azure AD (multi-tenant IDP) service, post authentication handshake it of course comes with a graph API, guarded by OAUTH tokens. The services is almost identical in role and concept to what in real estate one calls the RETS protocol (except that its modern and built into windows libraries). The (guarded) response data comes as webby RSS-ish streams, which of course focus on webby-style replication, crawling, push-pull, and "aggregation". The odata-query language is a nice addition, being somewhat more modern than 20 years old query languages used in real estate - an nicely tuned for set of attributes from multiple replicating attribute authorities. 

but, its web protocols are responsible for the quality of the replication, which is not intended to be the equivalent of a SQL replication, or a SAN async snapshot replication used in cloud deployments.

The world of real estate is a microcosm of the web, websso, and data-sharing via guarded APIs. What folks charged $50 per person using IT services 35 years ago, is now $5. Even those commoditized vendors must compete now with $0 offers too, with ads paying for all the services. The web allows for all these market dynamics and websso has only accelerated the demise of the enterprisy (real estate) web application. One MUST be webby (or get eliminated, by the raw economics).

As is always the case, the real paradigm shift technology - and I count websso and SAML in this category - fundamentally change society - through the impact they have on the economics.

loosely-couple your state, and use webby clustering/replication. Don't try to use the web to build out a Reuters application...





________________________________________
From: dev-bounces at shibboleth.net [dev-bounces at shibboleth.net] On Behalf Of Paul Hethmon [paul.hethmon at clareitysecurity.com]
Sent: Monday, November 12, 2012 6:41 AM
To: Shib Dev
Subject: Re: State Management and Clustering (IdP)

On 11/11/12 5:19 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>Speaking personally, I'm deeply skeptical of most clustering/replication
>technologies. I'm not a fan of asynchronous "best effort" replication, and
>most other types aren't very robust. I would be more comfortable with that
>for something like logout, that has no hope of being reliable anyway, than
>for mainline features like attribute queries.

To add a bit to this, even though I wrote that extension with Infinispan
for the current version, I've abandoned it for my own use. In my data
center, it worked pretty well, but in a few customer hosted sites, I had
problems even getting it working. Tuning the network parameters seems a
big challenge.

I ended up writing another storage plug-in that persisted sessions to a
database, with heavy support for not throwing errors if the database is
down. So I have a full local copy of anything that starts on that server,
send it to the database for persistence and to move the session to another
server. If a server doesn't have a local copy of the session, it will ask
the database for it. If it can't get it from the database, then that user
will simply have to login again.

It works, its simple. There are times when the effort to get something
cool like Infinispan working is just not worth it.

Paul

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net