IdP statelessclustering, memcached, other options?

[Jeffrey Eaton]

We are at the point where we are seriously looking at IdP clustering as a way to provide higher reliability and availability.

Our current configuration has our IdP service is behind an F5 load balancer. We currently have two servers, but run them in a warm-standby configuration, where at any given point one server handles all traffic.  The other is configured identically, but is not running Apache/Tomcat normally, and is only started if we need to fail over for some reason.  I could automate the failover, but that still means that all current sessions are invalidated.  Also, we must continue to support back-channel attribute queries, so session state must be shared between our IdPs.  We are using the username/password LoginHandler, authenticating via JAAS to Kerberos.

So, I'm looking at the options.

First, there is Terracotta.  Having experimented with this in the past, this seems to be a fairly complicated solution, with very fragile dependencies on the specific versions of Teracotta.  I had this running briefly, but rolled it back because of instability (sessions were not always being shared, and attribute queries would fail because of it).

Second there is  Manual Haim's Memcached StorageService, which may be able to be used with repcached to provide shared state.  Is anyone using this in production, either with or without repcached?

Second, there is the IdPStatelessClustering page in the wiki.  This appears to be able to be made to do what I need it to, with the caveat of needing a custom LoginHandler using DataSealer to provide SSO, and the CryptoTransientPrincipalConnector to provide back channel attribute queries.  Is anyone using this in production?  Is there a sample of how to use DataSealer with UsernamePassword in this way?

-jeaton

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20110815/7391c1f3/attachment.html