shibboleth-idp behind a load balancer?

[Gene Matthews]

Thanks for the response.  I will need to check out the load balancer in more detail.  

Should I see something in the idp-process.log though since it did make it through the load balancer to the idp error page.  I'm not seeing anything in the idp-process.log when this occurs.  I was hoping to see something there that might shed some light on why it thinks it is an invalid URL.

Thanks,

Gene



----- Original Message -----From: Nate Klingenstein <ndk at internet2.edu>To: Shib Users <users at shibboleth.net>Sent: Wed, 11 Dec 2013 19:04:55 -0500 (EST)Subject: Re: shibboleth-idp behind a load balancer?

There could be something in the dialect of load balancing being used here that needs to be understood, such as 8443 -> 443(more likely to cause problems) or 443 -> 443(less likely to cause problems).  Without knowing the precise details of how each portion of the setup is intended to run, it's hard to describe exactly how to string them together.


On Dec 12, 2013, at 8:59 AM, Jesse Santana <Jesse.Santana at csulb.edu>
 wrote:




Gene,
 
We have exactly this configuration here at CSULB. Our load balancer is configured to respond to idp.csulb.edu and has IP sticky session enabled so that all requests from a specific IP address are always sent to the same back end Shibboleth IdP. This works just fine and I have informed my user community that, should the IdP they are connected to fail, they will need to re-authenticate.  I&rsquo;m looking into memcached now to see if this can be addressed as well.
 
When I installed the first IdP, I define the FQN as idp.csulb.edu.  Once it was up and running, I setup the second IdP with the same FQN but then copied the idp-metadata.xml from the first IdP to make sure they were both the same.
 
I hope this helps and if I am doing something wrong, please someone feel free to say so.
 
Jesse
 

Jesse Santana
Assistant Director - Enterprise Systems and Servers
CSU Long Beach &ndash; Network Services
1250 Bellflower Blvd.
Long Beach, CA  90840
(562)985-8511
 

 


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Gene MatthewsSent: Wednesday, December 11, 2013 2:51 PMTo: Shib UsersSubject: shibboleth-idp behind a load balancer?


 


Hi,


 


I'm managing a shibboleth-idp that we have had in test and are now ready to move into production.  The production environment has two shibboleth-idp servers behind it.  They use LDAP as their back-end with LDAP replicating updates back and forth.  I believe I have the ldap replication working ok and from within the environment I can get the status page ('ok' fromhttps://myidpserver:8443/idp/profile/Status) to return 'ok'. 


 


When I go to the https://loadbalancer-for-idp:8443/idp/profile/StatusI land on the error-404.jsp page (invalid URL).  I don't control the load balancer and am working to see if there is any logging going on there.  I don't see anything in the idp-process.log when I do this.  Should I see something in the idp-process.log?  The http request is obviously getting through the load balancer or I would get the error-404.jsp page displayed.  I've edited the jsp page to  have the hostname displayed so I  know which of the two idp servers is ending up with the request (always idp1 so far).


 


Has anyone done anything like this?  Any reason shibboleth-idp couldn't operate in an environment like this?  Should I see something in the log?


 


Thanks for any insight.


 


Thanks,


 


Gene



--

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131212/1b1cf3f4/attachment-0001.html