Redis support for StorageService in opensaml-java?

[Cantor, Scott]

> I was thinking of using one of the MessageReplayHandlers that require
> StorageService. There was only memcached based Storage Service, and was
> thinking of using redis instead. I think in this case serverside storage is
> required, unless you have any other suggestion?

Most people just do per-node caches in memory and leave it. The only real significant case where replay checking is valuable for the IdP is for people supporting SOAP over 443 using signed messages from clients. Replay and freshness are (currently) the only real MITM mitigation there. But very few people are doing that.

If you're implementing an SP, replay checking matters more, but you shouldn't be implementing an SP.

Unicon has a hazelcast plugin available also.

-- Scott