Infinispan Based Storage Service

[Manuel Haim]

Paul,

your Infinispan storage service sounds pretty interesting!

However, I had a quick glimpse at the code, and I believe you're still
running into the same issues that we first had when implementing the IdP
Memcached StorageService [1]:

1) You already use a filter in web.xml which puts the changed object
back to Infinispan (for triggering the replication mechanism), this is fine!

2) As for the loginContext, we also do not store that, and instead use a
sticky load-balancer :)

3) AFAIK, Infinispan does not replicate object data which is not
serializable (i.e. "transient" fields and non-serializable class
objects). This will lead to a number of problems with several options of
the Shibboleth IdP:

web.xml:
retainSubjectsPublicCredentials - cannot be used
retainSubjectsPrivateCredentials - cannot be used

login.config (vt-ldap):
setLdapPrincipal - true by default, cannot be used

x509 login handler, Kerberos login handler:
- both have transient fields, cannot be used

Multiple keys within StorageService:
The Shibboleth IdP stores a Session object under multiple keys within
the StorageService (not only by sessionId). I guess if your filter only
calls Infinispan's "put" method by sessionId, the other objects (and
object keys) may not be updated. This may cause problems with artifact
resolution via IdP backchannel, as the Session object needs to be
available e.g. by principalName or transientId. So you should test the
back-channel by logging in to one IdP node and having back-channel
requests go to another IdP node (open relying-party.xml and set
includeAttributeStatement="false" within the saml:SAML2SSOProfile, so
the SP only gets an artifact and is forced to do artifact resolution).
Please also note that artifact resolution can also be forced by the SP
and is the default behaviour for the Shibboleth SP 1.x.

Hope this may be helpful for the moment,
Manuel


[1] IdP Memcached Storage Service
https://wiki.shibboleth.net/confluence/display/SHIB2/Memcached+StorageService


Am 04.07.2012 02:14, schrieb Paul Hethmon:
> I've placed the Infinispan based storage service I wrote for Shibboleth
> IdP v2 on Google Code:
> 
> http://code.google.com/p/infinispan-storage-service/
> 
> I'll get it linked from the Shibboleth wiki as well.
> 
> As mentioned earlier today, this is a replacement storage service for
> the default Shibboleth storage service. It is based on Infinispan
> (version 5.1.5.FINAL) to provide the cluster support. My examples use
> multi-cast UDP, but you can use any configuration that Infinispan
> supports, the code does not care.
> 
> Please make sure to read the README file for how to set it up. Not too
> involved, but it has a few steps.
> 
> This code has proven stable for me in a production environment, but I
> will say that I did pull the code out of a bigger Shibboleth project to
> put into this separate one. So it is certainly possible that I missed
> changing something. So don't roll out to your production environment
> without testing.
> 
> thanks,
> 
> Paul
> 
> 
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>