shibboleth-idp behind a load balancer?

[Tompkins,Charles R]

Gene,

We only forward 80 and 443 from our lb to the IdPs. You should find out what's configured there.

If you have doubts on why you are always hitting IdP1 when you hit the lb, take it out of the pool and try again. That behavior could be related to the type of policy your lb is using to "balance" requests.

-Charles

-----Original Message-----
From: Nate Klingenstein [ndk at internet2.edu]
Received: Wednesday, 11 Dec 2013, 7:05PM
To: Shib Users [users at shibboleth.net]
Subject: Re: shibboleth-idp behind a load balancer?

There could be something in the dialect of load balancing being used here that needs to be understood, such as 8443 -> 443(more likely to cause problems) or 443 -> 443(less likely to cause problems).  Without knowing the precise details of how each portion of the setup is intended to run, it's hard to describe exactly how to string them together.

On Dec 12, 2013, at 8:59 AM, Jesse Santana <Jesse.Santana at csulb.edu<mailto:Jesse.Santana at csulb.edu>>
 wrote:

Gene,

We have exactly this configuration here at CSULB. Our load balancer is configured to respond to idp.csulb.edu<http://idp.csulb.edu> and has IP sticky session enabled so that all requests from a specific IP address are always sent to the same back end Shibboleth IdP. This works just fine and I have informed my user community that, should the IdP they are connected to fail, they will need to re-authenticate.  I’m looking into memcached now to see if this can be addressed as well.

When I installed the first IdP, I define the FQN as idp.csulb.edu<http://idp.csulb.edu>.  Once it was up and running, I setup the second IdP with the same FQN but then copied the idp-metadata.xml from the first IdP to make sure they were both the same.

I hope this helps and if I am doing something wrong, please someone feel free to say so.

Jesse

Jesse Santana
Assistant Director - Enterprise Systems and Servers
CSU Long Beach – Network Services
1250 Bellflower Blvd.
Long Beach, CA  90840
(562)985-8511


From: users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> [mailto:users-bounces at shibboleth.net<mailto:bounces at shibboleth.net>] On Behalf Of Gene Matthews
Sent: Wednesday, December 11, 2013 2:51 PM
To: Shib Users
Subject: shibboleth-idp behind a load balancer?

Hi,

I'm managing a shibboleth-idp that we have had in test and are now ready to move into production.  The production environment has two shibboleth-idp servers behind it.  They use LDAP as their back-end with LDAP replicating updates back and forth.  I believe I have the ldap replication working ok and from within the environment I can get the status page ('ok' fromhttps://myidpserver:8443/idp/profile/Status) to return 'ok'.

When I go to the https://loadbalancer-for-idp:8443/idp/profile/StatusI land on the error-404.jsp page (invalid URL).  I don't control the load balancer and am working to see if there is any logging going on there.  I don't see anything in the idp-process.log when I do this.  Should I see something in the idp-process.log?  The http request is obviously getting through the load balancer or I would get the error-404.jsp page displayed.  I've edited the jsp page to  have the hostname displayed so I  know which of the two idp servers is ending up with the request (always idp1 so far).

Has anyone done anything like this?  Any reason shibboleth-idp couldn't operate in an environment like this?  Should I see something in the log?

Thanks for any insight.

Thanks,

Gene
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3238 bytes
Desc: not available
Url : http://shibboleth.net/pipermail/users/attachments/20131212/4ed27f99/attachment.bin