Shibboleth idp performance question

[Jim Ennis]

Hello shibboleth list,

We recently "shibbolized" our Peoplesoft Portal to use Shibboleth for authentication and we also use Shibboleth with Canvas and some other service providers for our authentication source.

Our Fall term started yesterday and our Shibboleth servers experienced some possible load issues, or possible F5 interactions, where when we hit around 300 logins per minute, we began to have the F5 detect a lack of response and start taking Shibboleth nodes offline which interrupted active logins and began to affect our overall portal access along with access issues with other resources using Shibboleth.

I believe we're running a pretty standard configuration on Solaris servers with good networking/performance (qty two Oracle T4 servers with Solaris 10).

We are running v2.3.8 of shibboleth.

The servers and the networking stack did not show signs of any significant load so we're wondering if there are some constraints in Shibboleth or tomcat that we have to adjust to handle more volume.

We have mitigated the issue at this time by disabling an https health check on the F5 and adding more Shibboleth servers to the configuration (borrow/steal them) and our logins resumed pretty good response after about 2 hours of impacts on our end-users.

Any advice or tips would be recommended.

--jim

Jim Ennis
Director Systems and Operations
University of Central Florida
12716 Pegasus Drive
CSB 308
Orlando, FL 32816

E-mail: jim.ennis at ucf.edu<mailto:jim.ennis at ucf.edu>
Voice: 407-823-1701
Fax: 407-882-9017

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130820/1f01202a/attachment.html