<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body dir="auto">
<div>The problem is that the front channel browser talks to one node with the info but the RP will make a direct connection itself which could go to any node. </div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">I don't think it's possible to support OIDC in a cluster without session sharing. Its inherent in the protocol. </div>
<div id="AppleMailSignature"><br>
</div>
<div id="AppleMailSignature">Paul<br>
<br>
<div><br>
</div>
(Please enjoy the autocorrect features if this phone)</div>
<div><br>
On May 3, 2016, at 6:34 PM, Nate Klingenstein <<a href="mailto:nate.klingenstein@utah.edu">nate.klingenstein@utah.edu</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div class="">
<div>
<blockquote type="cite" class="">
<div class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">I’m
piggy backing on my v2 db storage service. I have extended it to have direct support for storing OIDC sessions. With the direct back channel model of OIDC, I just didn’t see a way to support it without clustering the sessions.</span></div>
</blockquote>
</div>
<br class="">
</div>
<div class="">Have you spent any time looking at serialization methods that would associate the OAuth token with the issuing node, limiting the need for storing sessions in a database? Is there any potential there, or is it just an idea not worth pursuing?</div>
</div>
</blockquote>
<blockquote type="cite">
<div><span>-- </span><br>
<span>To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">
dev-unsubscribe@shibboleth.net</a></span></div>
</blockquote>
</body>
</html>