Load balancing both the SP and IdP

[Martin, Andrew J.]

We have a "master" virtual IP address in our F5 load balancer that hosts the pool of Shibboleth nodes. That's the actual service URL that's used everywhere. As I mentioned before, when we address Shibboleth through the "pool", only one server is considered active and will respond at a time.

However, we also have our load balancer set up so that we can address nodes individually from certain administrative VLANs. This has come in handy for monitoring the IdP status of each node from something like SCOM. If I want to test against the passive node, I'd simply use my workstations' local hosts file to repoint the shib service hostname to instead refer to the accessible IP address of the passive node, as opposed to the F5 pool (of all servers).  As long as I test with the workstation with the modded 'hosts' file, I can direct my requests to the 'passive' node while everyone else is still pointed to active. 

There may be some scenarios where this isn't ideal, but it's worked for testing most of my integrations. Just remember to clean up your hosts file when you're done, or you may be confused why things resolve incorrectly later...

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin P. Foote
Sent: Thursday, October 24, 2013 12:06 PM
To: Shib Users
Subject: Re: Load balancing both the SP and IdP


On Thu, 24 Oct 2013, Tom Zeller wrote:

>> It also makes upgrading a snap since we can test new upgrades and configurations on the "passive" node without necessarily affecting production.
>
> Just curious what criteria you use during testing to select a node. IP address ?

Sorry not the OP ..

Most ADCs or Loadbalancers allow you to select a specific node or pool
of nodes depending on incoming criteria.. so yea IP of originating request 
is pretty simple.

So for me when testing / upgrading. I enable a rule that says if my workstation 
is accessing the IdP service go to this particular node or pool that is defined on 
the ADC.



------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net