simple manual fail over for IDP

[Todd Piket]

FWIW, I plan on using the already described approach with a hardware load balancer in front of the IdP.  We will be able to fail over manually and/or have the LB fail over to the other IdP in case the main one goes down.  I know this means all authenticated users will have to reauthenticate to the new IdP, but it's an unlikely scenario.  Once we decide on a solution for running in an active-active mode (e.g., Terracotta or stateless clustering) then we won't need to worry about the fail over problem.

Regards,

Todd Piket
todd.piket at so.mnscu.edu

"If people are good only because they fear punishment, and hope for reward, then we are a sorry lot indeed."  -- Albert Einstein

On Apr 30, 2012, at 10:57 AM, Jim Fox wrote:

> 
> Switching DNS works well as long as you don't use any of the callback
> attribute methods.  We do this all the time. We use a short TTL and
> switch it from one idp system to the other (configured identically).
> Usually all the browser traffic moves from one to the other in a
> few minutes.
> 
> Jim
> 
> 
> On Mon, 30 Apr 2012, Cantor, Scott wrote:
> 
>> Date: Mon, 30 Apr 2012 06:39:39 -0700
>> From: "Cantor, Scott" <cantor.2 at osu.edu>
>> To: Shib Users <users at shibboleth.net>
>> Reply-To: Shib Users <users at shibboleth.net>
>> Subject: Re: simple manual fail over for IDP
>> 
>> On 4/30/12 9:35 AM, "jehan procaccia" <jehan.procaccia at it-sudparis.eu>
>> wrote:
>>> 
>>> most of the time , sso.domain.fr redirects to IDP1, when a maintenance
>>> occurs on IDP1, sso.domain.fr redirects to IDP2.
>> 
>> If you mean DNS, that won't work. You can lower the TTL on the zone and
>> get it to work better, but you ultimately cannot control what clients do.
>> There's also the problem that many libcurl versions shipping on Linux are
>> old enough to have a DNS caching bug and will hold onto the IP until
>> restarted.
>> 
>> -- Scott
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>