HA IDPs stateless behind load balancer with authentication via CAS

[Ted Fisher]

Just wanted to check that my understanding of doc on Stateless IDP clustering is correct.  We have a pair of 2.1.3 IDPs that we are upgrading to 2.4.0.  The existing are clustered with Terracota. But, since they were put in place we have put a pair of clustered CAS servers doing the authentication and SSO session management for the IDPs.  Having done that we don’t really need to use Terracota any more for the IDPs.  We can (and will) use sticky sessions on the load balancer so that browsers stick to the same IDP through the duration of the authentication process.
It seems that there would be minimal impact if an IDP failed and all requests went to the other IDP since that IDP would depend on CAS for the SSO session.  The only impact would be on authentications that are in process when an IDP dies in which case they would need to try again (should be few so easily acceptable).
We are not trying to use SLO.  We simply have all logout URLs call our central logout URL which then calls to each known service that we provide (sloppy but effective).
It would seem unnecessary – even foolish – to add Terracota to our new 2.4.0 IDPs in this situation.

Am I missing something?
Is there any other factor to take into account for this?

Input on this is appreciated.

Thanks.

Ted F. Fisher
Information Technology Services
Bowling Green State University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131213/9c02cb29/attachment-0001.html