two apache instances using one shibd process possible?

[Gernot Hassenpflug]

Dear all,

I'm trying to use nginx (offloading SSL here) as a front end
configured to use two upstream httpd "backends", one listening at
127.0.0.1:81, the other at 127.0.0.2:81.

The reason is to try to overcome the memory limit on 32-bit apache,
since we are using mod_perl with preforked apache.

Each httpd process has its own init script, and has different log
files. Other than that, their Listen directive reflects the local IP
(127.0.0.1:81 or 127.0.0.2:81, respectively).

Now, if I have only one backend active (either one), SP and IdP
communicate perfectly.

However, if I activate both, then I receive the IdP login screen
correctly, but after entering the user credentials the IdP seems to
continuously send the redirect messages, without the redirect actually
happening in the browser. This seems to indicate some kind of looping,
but I am unsure where, and also whether the architecture I am using is
technically possible.

Finally, after tens of seconds, the IdP login page is presented
again. The final IdP log message is then a lack of login
context. Below is an extract from my idp-process.log:

...
...
18:30:16.798 - INFO [Shibboleth-Access:74] - 20130130T093016Z|202.224.53.1|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:30:16.960 - INFO [Shibboleth-Access:74] - 20130130T093016Z|202.224.53.1|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:30:17.053 - INFO [Shibboleth-Audit:989] - 20130130T093017Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_c9b146eb6a5a8e6eab12249866c01de6|https://ct.ritsumei.ac.jp/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://id
ptest.manaba.jp/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_bd2446ce04e55029a988f82176bc3c81|mastu007|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,transientId,|_8c0f9cfb43867ab39a1f516a9361514f
||
18:30:17.265 - INFO [Shibboleth-Access:74] - 20130130T093017Z|202.224.53.1|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:30:17.433 - INFO [Shibboleth-Access:74] - 20130130T093017Z|202.224.53.1|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:30:17.520 - INFO [Shibboleth-Audit:989] - 20130130T093017Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_f51c7d81be83d27718c48f3fce2f25bf|https://ct.ritsumei.ac.jp/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://id
ptest.manaba.jp/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_b814392c19d99a227aa32b11b794e462|mastu007|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,transientId,|_8c0f9cfb43867ab39a1f516a9361514f
||
18:30:17.693 - INFO [Shibboleth-Access:74] - 20130130T093017Z|202.224.53.1|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:32:49.241 - INFO [Shibboleth-Access:74] - 20130130T093249Z|202.224.53.1|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:32:49.459 - INFO [Shibboleth-Audit:989] - 20130130T093249Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_8eb16f10e22ebd2262a056c4c6441ec6|https://ct.ritsumei.ac.jp/shibboleth|urn:mace:shibboleth:2.0:profiles:saml2:sso|https://id
ptest.manaba.jp/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_4d76d2a878caff5d84ed7296562ca0ad|mastu008|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|uid,transientId,|_9ee1b95936f8c56028fcd6ec44a88a9a
||
18:45:27.859 - INFO [Shibboleth-Access:74] - 20130130T094527Z|64.124.203.71|idptest.manaba.jp:443|/profile/SAML2/Redirect/SSO|
18:45:29.315 - WARN [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:217] - No login context available, unable to proceed with authentication


Is there any problem I should be aware of in the shibd configuration? Local logins (on a different un-protected URL on the same domain) work fine.

Best regards,
-- 
Gernot Hassenpflug