Questions about setup a clustered Shib IdP

[Cantor, Scott]

On 3/19/13 6:32 PM, "Yaowen Tu" <yaowen.tu at gmail.com> wrote:
>
>1. If several IdP nodes act as a cluster, does it mean that they have to
>use the same keystore? Then should we put the keystore file into a shared
>location? or just copy the same keystore file to all the nodes?

I wouldn't think anybody would really advocate putting private keys on
shared storage.

>2. Similar to keystore file, should all the IdP have the same
>configuration? What if we need to update the config file e.g. adding an
>SP. We need to go to each IdP to update the file, and restart it? During
>this process, some weird things may happen since not
> all the nodes in the cluster have the same configuration, is it? How do
>we usually handle it?

I can't say anything about terracotta, I don't know how it works. I would
guess there would be problems with any kind of bytecode differences across
systems, which is one reason it terrifies me.

But I can say that with any cluster, there's no single answer to your
question. Differences in configuration are distinct in their implications
and you have to understand what the difference means to answer such a
question in any specific case, as well as the detailed characteristics of
your own deployment, such as what profiles are used, how they work, how
clustering affects them, that kind of thing.

And there are different clustering approaches with vastly different
characteristics in their own right.

-- Scott