IdP statelessclustering, memcached, other options?

[Roy, Nicholas S]

Sorry for the late reply, I just now saw this.  The University of Iowa has been using stateless clustering in production since early August.  We took a little bit different approach- we use the cryptographic transientID/DataSealer bean to support the back channel requests, but we left the UsernamePassword login handler as-is and used cookie-based session affinity via our load balancing device to keep SSO sessions pointed at the same node for the length of the session.  This approach has been working well.

Nick

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, August 17, 2011 4:42 PM
To: users at shibboleth.net
Subject: Re: IdP statelessclustering, memcached, other options?

Jeff,

I had the same experiences and currently still run the exact same setup (except for the loadbalancer vendor) for much the same reasons.

* Jeffrey Eaton <jeaton at cmu.edu> [2011-08-15 21:52]:
> So, I'm looking at the options.

I wrote up a small document with all (well, most) the variants of running an IdP service I could think of, by increasing complexity of the setup. Hopefully I'll get around to adding it to the wiki (or
wherever) some time next week. Nothing really new, of course.

> Second there is  Manual Haim's Memcached StorageService, which may be 
> able to be used with repcached to provide shared state.  Is anyone 
> using this in production, either with or without repcached?

Except Manuel, you mean? I doubt it as this has only been available for a couple of weeks now.
The "partitioned failure" scenario Manuel mentioned reminded me of the Cyrus Murder design (without replication), so may be "good enough" but introduces new dependencies, so might be more fragile.

> Second, there is the IdPStatelessClustering page in the wiki.

Same here, I suppose, i.e., I don't expect production use outside of OSU yet. But with Scott releasing the login handler code (Thanks
Scott!) this may change soon. At least it's next on my list wrt Shib, once I clear out some of the backlog after being offline for a couple weeks.
-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net