Load balancing both the SP and IdP

[David Bantz]

On Thursday, 24 October 2013 at 10:06:02, Jesse Santana (jesse.santana at csulb.edu) wrote:

Our configuration at CSU Long Beach is almost identical to the one Andrew described. The question I have for Andrew is, how do you handle session replication? As our configuration stands today, if one of our IdP's dies, the users bound to that IdP must re-authenticate. How are you avoiding this? I am looking into memcached as a possible solution but wanted to hear your thoughts. 
We have this config for our IdP as well and also operate as described to implement and test changes against the passive node from workstations with modified hosts file.  For net reliability, you have to trade off the non-trivial complexity of session replication across nodes against the modest increase in reliability gained.  In our case, neither the IdP service nor the platform on which it runs have “died” in the past 4 years (though an incorrect config change once caused an interruption of a few minutes).  

David Bantz



Jesse Santana 
Assistant Director - Enterprise Systems and Servers 
CSU Long Beach - Network Services 
1250 Bellflower Blvd. 
Long Beach, CA  90840 
(562)985-8511 


-----Original Message----- 
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Martin, Andrew J. 
Sent: Thursday, October 24, 2013 10:51 AM 
To: Shib Users 
Subject: RE: Load balancing both the SP and IdP 

We have a "master" virtual IP address in our F5 load balancer that hosts the pool of Shibboleth nodes. That's the actual service URL that's used everywhere. As I mentioned before, when we address Shibboleth through the "pool", only one server is considered active and will respond at a time. 

However, we also have our load balancer set up so that we can address nodes individually from certain administrative VLANs. This has come in handy for monitoring the IdP status of each node from something like SCOM. If I want to test against the passive node, I'd simply use my workstations' local hosts file to repoint the shib service hostname to instead refer to the accessible IP address of the passive node, as opposed to the F5 pool (of all servers). As long as I test with the workstation with the modded 'hosts' file, I can direct my requests to the 'passive' node while everyone else is still pointed to active. 

There may be some scenarios where this isn't ideal, but it's worked for testing most of my integrations. Just remember to clean up your hosts file when you're done, or you may be confused why things resolve incorrectly later... 

-----Original Message----- 
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Kevin P. Foote 
Sent: Thursday, October 24, 2013 12:06 PM 
To: Shib Users 
Subject: Re: Load balancing both the SP and IdP 


On Thu, 24 Oct 2013, Tom Zeller wrote: 

>> It also makes upgrading a snap since we can test new upgrades and configurations on the "passive" node without necessarily affecting production. 
> 
> Just curious what criteria you use during testing to select a node. IP address ? 

Sorry not the OP .. 

Most ADCs or Loadbalancers allow you to select a specific node or pool of nodes depending on incoming criteria.. so yea IP of originating request is pretty simple. 

So for me when testing / upgrading. I enable a rule that says if my workstation is accessing the IdP service go to this particular node or pool that is defined on the ADC. 



------ 
thanks 
kevin.foote 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131024/9fdc5a20/attachment-0001.html