HA IDPs stateless behind load balancer with authentication via CAS

[Ted Fisher]

Thanks Scott.  To follow up on a couple:

>> We are not trying to use SLO.  We simply have all logout URLs call our 
>> central logout URL which then calls to each known service that we 
>> provide (sloppy but  effective).

> Does that work without third party cookies?
I think - it's not very pretty.  We have a URL with a big ugly list of every app we know that we provide with SSO which just goes out to each and tries to logout the user session.  Our Apps group maintains that and I simply make sure for each new service we add to Shib or CAS I get a logout URL for that App and forward it to that team who adds it to the big ugly list.  Logout from any page is then supposed to redirect to this global logout URL which just goes everywhere trying to end any open sessions.

>>Am I missing something?
>>Is there any other factor to take into account for this?

> Well, if you have a need for attribute query for legacy reasons or some other reason, you need to configure alternate plugins to 
> support that kind of transient NameID, but that's about it.

If we have virtual IPs set to sticky shouldn't we be able to let it use the transient NameID since stickiness will make sure it gets back to the same IDP.  Again, the only flaw there is an IDP failure just before a client session asks for attributes, but in those rare cases the user can simply re-authenticate which will take place on the remaining IDP.   
But, other than during a failure attribute queries should succeed with transient ID, right?

Ted F. Fisher
Information Technology Services
Bowling Green State University