load-balancing tests and the shib IdP

[Michael R. Gettes]

Hi All,

I have been plowing through list archives and googling like mad and can't really find anything to answer the following situation.

We have an F5 load-balancer for 2 Shib IdPs.  All is well.  We recently had a problem where, for circumstances unrelated to shib, the JVM crapped out.  Because the httpd was still responding, some of the connections were still going to the down IdP.  We have been trying to determine what is the most appropriate test to make sure the IdP is really up and functioning.  We came up with the following url:

https://shibidp-NN.blah.edu/idp/profile/SAML2/Unsolicited/SSO?providerId=https://shibidp.blah.edu/shibboleth

and we tell our F5 to look for the "302 Moved Temporarily" response.  Anything else indicates a problem and the target host should be removed from the load-balancing pool.

Are we thinking about this properly?  Doing so appears to be creating a session for the shib IdP.  Are there concerns about how many of these occur?  the load-balancer could be doing this every second or even more frequently.

What have you done with respect to the capabilities of an F5 or similarly capable load-balancing device for shib IdPs?

If there is a pointer to a document explaining all this - I'd be eternally grateful.

Many thanks in advance.

/mrg