Load balancing both the SP and IdP

[Jesse Santana]

Our configuration at CSU Long Beach is almost identical to the one Andrew described.  The question I have for Andrew is, how do you handle session replication?  As our configuration stands today, if one of our IdP's dies, the users bound to that IdP must re-authenticate.  How are you avoiding this?  I am looking into memcached as a possible solution but wanted to hear your thoughts.

Jesse Santana
Assistant Director - Enterprise Systems and Servers
CSU Long Beach - Network Services
1250 Bellflower Blvd. 
Long Beach, CA  90840
(562)985-8511


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Martin, Andrew J.
Sent: Thursday, October 24, 2013 10:51 AM
To: Shib Users
Subject: RE: Load balancing both the SP and IdP

We have a "master" virtual IP address in our F5 load balancer that hosts the pool of Shibboleth nodes. That's the actual service URL that's used everywhere. As I mentioned before, when we address Shibboleth through the "pool", only one server is considered active and will respond at a time.

However, we also have our load balancer set up so that we can address nodes individually from certain administrative VLANs. This has come in handy for monitoring the IdP status of each node from something like SCOM. If I want to test against the passive node, I'd simply use my workstations' local hosts file to repoint the shib service hostname to instead refer to the accessible IP address of the passive node, as opposed to the F5 pool (of all servers).  As long as I test with the workstation with the modded 'hosts' file, I can direct my requests to the 'passive' node while everyone else is still pointed to active. 

There may be some scenarios where this isn't ideal, but it's worked for testing most of my integrations. Just remember to clean up your hosts file when you're done, or you may be confused why things resolve incorrectly later...

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin P. Foote
Sent: Thursday, October 24, 2013 12:06 PM
To: Shib Users
Subject: Re: Load balancing both the SP and IdP


On Thu, 24 Oct 2013, Tom Zeller wrote:

>> It also makes upgrading a snap since we can test new upgrades and configurations on the "passive" node without necessarily affecting production.
>
> Just curious what criteria you use during testing to select a node. IP address ?

Sorry not the OP ..

Most ADCs or Loadbalancers allow you to select a specific node or pool of nodes depending on incoming criteria.. so yea IP of originating request is pretty simple.

So for me when testing / upgrading. I enable a rule that says if my workstation is accessing the IdP service go to this particular node or pool that is defined on the ADC.



------
thanks
  kevin.foote
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net