HA IDPs stateless behind load balancer with authentication via CAS

[Cantor, Scott]

On 12/13/13, 9:36 AM, "Ted Fisher" <tffishe at bgsu.edu> wrote:

>I think - it's not very pretty.  We have a URL with a big ugly list of
>every app we know that we provide with SSO which just goes out to each
>and tries to logout the user session.  Our Apps group maintains that and
>I simply make sure for each new service we add to Shib or CAS I get a
>logout URL for that App and forward it to that team who adds it to the
>big ugly list.  Logout from any page is then supposed to redirect to this
>global logout URL which just goes everywhere trying to end any open
>sessions.

Unless the redirect is in the top level frame/window, then no, that
doesn't work without third party cookies. Unless you assume the app
doesn't need the cookie to do a logout, which isn't typical.

>If we have virtual IPs set to sticky shouldn't we be able to let it use
>the transient NameID since stickiness will make sure it gets back to the
>same IDP.
>Again, the only flaw there is an IDP failure just before a client session
>asks for attributes, but in those rare cases the user can simply
>re-authenticate which will take place on the remaining IDP.
>But, other than during a failure attribute queries should succeed with
>transient ID, right?

The issue isn't transients, it's the transient mapping to a user. If the
mapping is in memory, you can't make queries work. There is no stickiness,
you have two different systems, the client and the SP and they can't both
be assured of hitting the same server.

If you want queries to work, the issue is documented in the page. You have
to generate a shared keystore and switch to the crypto transient plugins.

-- Scott