session not sticky or something else?

[Michael A Grady]

The crypto transient stuff is pretty easy to setup, and there is good documentation in the Shib wiki to guide you thru it. If that meets your needs, it is quite a bit smaller step to take than going to Terracotta. (How do you do authentication for your IdP today? Is it itself layered over an SSO, or does it do username/password directly against LDAP or similar?)

But if you only have a few SPs that are still using a SP 1.x/SAML 1.1 version of the SP, the easiest thing from your perspective would be to get those services to upgrade to a Shib 2.x SP and push attributes. And that would put them on actual supported code.

On Jan 7, 2013, at 10:32 AM, Cantor, Scott wrote:

> On 1/7/13 11:13 AM, "Nickles, Brent" <bnick001 at umaryland.edu> wrote:
> 
>> We have an IdP that is behind a Cisco Load balancer (two servers)Š.when
>> only one server is up, everything is fine, but when both servers are
>> active I get a failure.   If I¹m understanding correctly, the second
>> machine (for the SOAP call) doesn¹t know what the transient identifier is
>> and fails.   This is only happening against a certain SP, is this a
>> configuration issue, can it be resolved at the load balancer with
>> cookies, or is this where Terracotta comes in?
> 
> The latter, or you need to switch to the crypto plugins that generate
> transients using a shared key. Or you push attributes and stop using
> queries.
> 
> You can't use stickiness, there are two different machines involved, the
> client and the SP.
> 
> -- Scott
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.