TCP socket configuration for SP

[Christopher Bongaarts]

On 7/27/2012 4:50 PM, Cantor, Scott wrote:
> On 7/27/12 5:15 PM, "Christopher Bongaarts" <cab at umn.edu> wrote:
 >>
>> The idea is to have a "warm spare" shibd ready to kick into action
>> should the primary one fail, with only configuration change and Apache
>> restart needed to effect the failover.
>
> I'm not sure what that accomplishes vs. just restarting the service.
> Either way it's a disruption since there's no state preserved. Are you
> seeing crashes? To be honest, that would make the software useless. It has
> to be bulletproof or it's a pretty big pain.

Just trying to cover the DR bases since we're introducing a single point 
of failure.

The problem that led to this is a stateless application using DNS round 
robin A records for load distribution.  In our old SSO system, clients 
could bounce between servers with impunity.  Now that we have the Shib 
SP in the picture, there is suddenly state involved.

So we're moving from three servers with an SP and shibd of their own, to 
three SPs sharing a single shibd on one of them.  The idea was to use 
the other two servers' shibds as warm spares.

On a related note: is there a way to parameterize the listening address? 
  The shibboleth2.xml files are currently identical between the three 
boxes and it would be ideal to keep them as similar as possible.  If all 
else fails we can always build the config file at server start time 
using a little XSLT magic.
-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%