Load balancing both the SP and IdP

[Brian Reindel]

I just wanted to clarify a scenario from my original question (I know
the thread has started to go in a different direction). So now we have
a single IdP that is not load balanced. However, our SP is load
balanced. If the SP were not sticky, and the IdP could potentially be
communicating with any SP in the cluster, will this be problematic at
all? Scott, you originally said the SP doesn't enter into it, but I
just wanted to be sure I understand that correctly. What we're seeing
is our load balancer is pushing traffic back and forth to different
SPs in the cluster, and we're getting stuck in an infinite loop. If I
modify my hosts file and lock it down to the IdP and an SP living on
the same IP then it works just fine. Now it could obviously be a load
balancer issue, but I'm trying to eliminate the SP as the root cause.

On Thu, Oct 24, 2013 at 2:40 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/24/13, 2:34 PM, "Jesse Santana" <Jesse.Santana at csulb.edu> wrote:
>
>>David,
>>
>>Agreed.  We have not had a failure either.  I¹m only now looking into
>>this because our Shibboleth environment is becoming more mission critical
>>and our powers
>> that be are requesting full redundancy wherever possible.
>
> Note that if the only cost of not replicating is extra logins at times,
> that isn't really much cost. There are entire campuses that use LDAP
> authentication and don't do any SSO.
>
> But that said, the biggest cost to me is tha users switching nodes
> mid-login will get errors because of the login context issue (and that's
> also an issue going forward with V3, Spring WebFlow uses a conversation
> cookie and maintains state in RAM without a whole lot of non-realistic
> work).
>
> So a lot of the various strategies for active/passive are more about what
> the disruption is for those transactions, not so much the issue of
> replicating sessions.
>
> --  Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net