simple manual fail over for IDP

[Jim Fox]

Switching DNS works well as long as you don't use any of the callback
attribute methods.  We do this all the time. We use a short TTL and
switch it from one idp system to the other (configured identically).
Usually all the browser traffic moves from one to the other in a
few minutes.

Jim


On Mon, 30 Apr 2012, Cantor, Scott wrote:

> Date: Mon, 30 Apr 2012 06:39:39 -0700
> From: "Cantor, Scott" <cantor.2 at osu.edu>
> To: Shib Users <users at shibboleth.net>
> Reply-To: Shib Users <users at shibboleth.net>
> Subject: Re: simple manual fail over for IDP
> 
> On 4/30/12 9:35 AM, "jehan procaccia" <jehan.procaccia at it-sudparis.eu>
> wrote:
>>
>> most of the time , sso.domain.fr redirects to IDP1, when a maintenance
>> occurs on IDP1, sso.domain.fr redirects to IDP2.
>
> If you mean DNS, that won't work. You can lower the TTL on the zone and
> get it to work better, but you ultimately cannot control what clients do.
> There's also the problem that many libcurl versions shipping on Linux are
> old enough to have a DNS caching bug and will hold onto the IP until
> restarted.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>