Terracotta

[Peter Schober]

* Baird-Parker, David <David.Baird-Parker at norfolk.gov.uk> [2012-10-11 09:46]:
> now that we have an IdP back up and running we ideally want to have a
> second machine.  Naively, I thought it would just be a case of adding a
> second server and load balancing which works to a point but logins fail
> on server 2.  I've been advised by the UK Fed to follow the instructions
> at https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCluster

Well, if you can forgo back channel requests (SOAP requests directly
from the SP to the IDP) you could get by with two IdPs behind a load
balancer with session affinity (sticky sessions).
Only in case of failover or switchover (i.e., when one of the IdP
nodes is unavailable) users would have to reauthenticate at the
(other) IdP and only when they try to access an SP without an active
session there.
That seems to go a long way and involves *no* setup or special
configuration at the IdP.
-peter