Load balancing both the SP and IdP

[Cantor, Scott]

On 10/24/13, 5:58 PM, "Brian Reindel" <brian at reindel.com> wrote:

>I just wanted to clarify a scenario from my original question (I know
>the thread has started to go in a different direction). So now we have
>a single IdP that is not load balanced. However, our SP is load
>balanced.

You can't load balance the SP without clustering the session cache or
implementing stickiness.

> If the SP were not sticky, and the IdP could potentially be
>communicating with any SP in the cluster, will this be problematic at
>all?

IdPs don't communicate with SPs. We don't support SAML logout, and
unless/until we do, there is no SOAP communication from IdP to SP. Ever.

> If I modify my hosts file and lock it down to the IdP and an SP living on
>the same IP then it works just fine. Now it could obviously be a load
>balancer issue, but I'm trying to eliminate the SP as the root cause.

The IdP has nothing to do with it. You're locking your client to one SP,
and that's why it's working.

-- Scott