<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
I was curious whether you could put something into the token that the client delivers that could be intercepted by a load balancer to inspect and direct the query to the right node. It would be somewhat customized, but it doesn’t seem like it would be too
hard to, e.g., fix the first byte to a node identifier.
<div class=""><br class="">
</div>
<div class="">But that’s helpful, thanks for taking the time to think it through.<br class="">
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On May 3, 2016, at 16:47, Paul Hethmon <<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
The problem is that the front channel browser talks to one node with the info but the RP will make a direct connection itself which could go to any node. </div>
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br class="">
</div>
<div style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
I don't think it's possible to support OIDC in a cluster without session sharing. Its inherent in the protocol. </div>
<br class="Apple-interchange-newline">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</body>
</html>