TCP socket configuration for SP

[Cantor, Scott]

On 7/28/12 12:48 AM, "Christopher Bongaarts" <cab at umn.edu> wrote:
>
>Just trying to cover the DR bases since we're introducing a single point
>of failure.

I get that aspect, but unfortunately the client connection here doesn't
really support any form of redundancy, because it's meant to be a state
cache, and if you lose the state, you lose the ability to treat things
redundantly. If you had something like ODBC or memcache in place, and then
added a load balanced connection to multiple shibds, I guess that would be
the closest, but once you remove the state from the process, the general
idea is you restart shibd any time it would fail (which is rare) and
minimize most of the problems.

>The problem that led to this is a stateless application using DNS round
>robin A records for load distribution.  In our old SSO system, clients
>could bounce between servers with impunity.  Now that we have the Shib
>SP in the picture, there is suddenly state involved.

Is the application actually using the SSO session?

>So we're moving from three servers with an SP and shibd of their own, to
>three SPs sharing a single shibd on one of them.  The idea was to use
>the other two servers' shibds as warm spares.

I would warn you that we've seen issues with that in one case here at OSU
because of a network issue between the systems. I'm not sure yet what the
cause is, and I have no reports of it anywhere else. It also is
*definitely* slower, much slower. When you have content that includes a
lot of internal protected page content, you get a lot of overhead.

I definitely don't expect people to treat the SP as a cluster solution, I
always assume that's an app session use case.

>On a related note: is there a way to parameterize the listening address?
>  The shibboleth2.xml files are currently identical between the three
>boxes and it would be ideal to keep them as similar as possible.  If all
>else fails we can always build the config file at server start time
>using a little XSLT magic.

Not currently, and I never get around to experimenting with XML entities.
And I think with various security settings in the parser, I probably end
up blocking entity resolution anyway, but I haven't verified that.

-- Scott