Terracotta

[Russell Beall]

The Terracotta project has regularly been breaking APIs and failing to provide backward compatibility in configuration to earlier versions, and doing this in between major releases.  At each new minor release version, there have been differences to accommodate, so use of a newer version is not recommended unless you have the time to sort out and test those differences.

Because of this and issues with high load, Terracotta is not necessarily the ideal choice.

I use TC version 3.5.1 in production for Shibboleth, both on Linux and Solaris, and this has been very stable.

This is an option if you don't have hundreds of thousands of logins every day, or you have plenty of hardware.

Another recommended solution is to use the cryptographic plugin for generating and responding to NameIDs.
https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverCryptoTransientIDAttributeDefinition
https://wiki.shibboleth.net/confluence/display/SHIB2/CryptoTransientPrincipalConnector

This allows for attribute queries between nodes without clustering.

For this to be a complete solution, you would either need perfect session stickiness with a loadbalancer, or use the Ohio State plugin for using previous session information from a cookie:  This is available on the contributions page:
https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions

There is also another clustering solution based on Infinispan available from that page.

Regards,
Russ.

On Oct 11, 2012, at 12:45 AM, Baird-Parker, David wrote:

> Hi everyone,
> now that we have an IdP back up and running we ideally want to have a second machine.  Naively, I thought it would just be a case of adding a second server and load balancing which works to a point but logins fail on server 2.  I’ve been advised by the UK Fed to follow the instructions at https://wiki.shibboleth.net/confluence/display/SHIB2/IdPCluster
>  
> However, those instructions are for Terracotta 3.2.1 and the current version is 3.7.0 available from http://terracotta.org/downloads/open-source/catalog
> and as I’ve got Windows servers what would have been available as an exe file now only seems to be available as a jar file so I’m thinking a lot could go wrong if I try to apply the previous instructions to the new version.
>  
> Has anyone got experience with this version of Terracotta?  If so, what did you do differently to previous versions and how well does it work.  If you’ve used something else to make multiple IdP’s work together that you think might serve us better I’d like to know about that too before starting on this.
>  
> Any help would be appreciated.
>  
> Thanks,
> David
> --
> 
> To see our email disclaimer click here http://www.norfolk.gov.uk/emaildisclaimer
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121011/816a00a3/attachment.html