Shibboleth without attribute queries and artifact resolution

[Wessel, Keith William]

Hi, Russ,

A great question. No known security issues, just the fact that we're still on 3.2.1, and I thought it might be time for an upgrade. I was also hoping that a newer version might be a bit more graceful in handling our heap space issues with the TC Java instance, though I known nothing specific that's been changed since 3.2.1 that deals with memory usage specifically.

We also had a weird case a couple weeks ago when a passive standby node never finished iinitializing but also never crashed. A week later, when it was needed to become active while the previously active node was patched, bad things obviously happened. We had nothing specific from the logs to say why it just hung during initialization, but we thought an upgrade might help.

I guess a good question might be are others out there still running Terracotta 3.2.1?

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Russell Beall
Sent: Monday, December 17, 2012 12:46 PM
To: Shib Users
Subject: Re: Shibboleth without attribute queries and artifact resolution

Terracotta has "bit us" when they make an upgrade, but the existing software has been stable and functional.

Was there a pressing reason to upgrade, such as a security concern?

Regards,
Russ.

On Dec 14, 2012, at 12:05 PM, "Wessel, Keith William" <kwessel at illinois.edu> wrote:

> Thanks, both Kevin and Scott. And sorry about the wrong subject line out of the gate!
> 
> Terracotta has bit us enough times that we're now ready to have any excuse we can to get rid of it. Kevin, if in fact the TIMs are no longer needed, we look forward to hearing your findings as plan B. For now, though, think we'll look into enabling crypted transient IDs and turning off the artifact resolution.
> 
> Keith
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net 
> [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
> Sent: Friday, December 14, 2012 2:00 PM
> To: Shib Users
> Subject: Re: Shibboleth without attribute queries and artifact 
> resolution
> 
> On 12/14/12 2:53 PM, "Kevin P. Foote" <kpfoote at iup.edu> wrote:
> 
>> 
>> On Fri, 14 Dec 2012, Cantor, Scott wrote:
>> 
>> -> Are they supporting newer versions or literally not supporting Tomcat?
>> -> That seems extreme.
>> 
>> Don't want to hijack Keith's thread .. But before TC version 3.x.x 
>> (back on the 2 series) we did not need a tim for tomcat.
>> 
>> I have yet to spin up my test rig and test this out but I think they 
>> might have gone back to that model.
>> 
>> All we needed back then was the tim-vector to get the sessions (and
>> junk) stored in TC.
> 
> Thanks, Kevin. If anything is concluded, could something be added to 
> our documentation? I don't feel qualified to really try to capture it 
> since I've never touched the software.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net