Recommended configuration for SP high availability

[Jim Hoy]

Hi all,

I'm just getting started with a new SP installation to protect a service we
believe will be very very active in short time. To keep up with the demand
we expect from our users, we're load balancing our application which is
IIS/SQL Server. We will have a LOT of users from a LOT of different
institutions using our application. Most will use SAML/Shibb for
authentication. Not only will we have a lot of users, we expect a lot of
concurrent users. High-availability is a must.

Before posing my actual question I should mention that we'll be using the
SP in the "bootstrap" fashion, wherein we'll be initiating an
authentication request to the IdP and getting the response. From there,
we'll look at the return attributes and make a decision about what
permissions/roles/accessibility the user has. We'll create a session for
the user in our application at which point we no longer care about the
Shibboleth session. Our load balancer is round-robin and we are leaning (as
my CTO says) HEAVILY away from server affinity or stickiness.

So my question for this group is: If I install the Shibb SP on each server
is it true that if server[1] in my load balancer accepts a user request for
protected resources and initiates an authentication request to the proper
IdP, (based on the previous paragraph) can server[2] handle the POST coming
from the IdP (if so chosen by the load balancer) so I can log in my user as
described? Again, I won't need the Shibboleth session (that I'm aware of).
If that turns out to not be true, what might you recommend.

Thanks,

-Jim
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130715/47a402f6/attachment.html