[Ext] openid plugin and attributes

[Nate Klingenstein]

I was curious whether you could put something into the token that the client delivers that could be intercepted by a load balancer to inspect and direct the query to the right node.  It would be somewhat customized, but it doesn’t seem like it would be too hard to, e.g., fix the first byte to a node identifier.

But that’s helpful, thanks for taking the time to think it through.

On May 3, 2016, at 16:47, Paul Hethmon <paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>> wrote:

The problem is that the front channel browser talks to one node with the info but the RP will make a direct connection itself which could go to any node.

I don't think it's possible to support OIDC in a cluster without session sharing. Its inherent in the protocol.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160503/bce85906/attachment.html>