stateless IdP clustering with vs without SSO patch

[Jim Fox]

> A user logs into site on sp1 and is planning to be online for at least 8
> hours. By luck of the draw, first authentication is against idp1. For
> the next four hours, there is no interaction with the IDPs. At the four
> hour mark, the session expires so sp1 checks in with idp-lb - if it gets
> idp1 again, all is well for another 4 hours. If it gets idp2 this time,
> idp2 refers user to the authentication mechanism which (for Stanford at
> least) uses an SSO cookie and so re-authenticates the user transparently
> and then idp2 starts a new 8 hour session with sp1.

This SSO login involves a couple of redirections.  The user is
bounced to the authentication system and then back.  If the user
comes 'back' to idp1 instead of idp2 she gets the "service requires
cookies" message.

You need system affinity for at least the login loop.

Jim