Shibboleth IdP platform upgrade

[Cantor, Scott]

On 2/23/14, 11:20 PM, "Sharma, Dattathreya" <datta at ucla.edu> wrote:

>Tomcat 7 ­ Client certification validation is not optimal under Tomcat 7.
>It should not be an issue for us, our IdP is fronted by Apache httpd
>anyway.

There's a plugin that works for Tomcat 7, but no, it doesn't matter. I
would note that the Tomcat/Jetty plugins work much better than Apache
does. mod_ssl "optional_no_ca" is broken in a number of ways on various
kinds of certificates and they show no interest in fixing it, so it's not
a bad thing to evaluate exposing port 8443 directly from the container
even if 443 isn't.

>Clustering - There is no support for Terracotta DSO under Java 7. We have
>to use an alternate clustering solution or go Stateless which has some
>features limitations.

Yes, that's true. While the implementation won't be the same, using a
database via Paul's plugin will work for V3, and there's also memcache, in
addition to the stateless option. Plus the more creative approaches like
Jim's.

For cases where single logout isn't needed, I suspect the default solution
in V3 will be stateless because the client-side cookie storage for basic
session information has seemed to work very well. It just can't handle
storing references to all the SPs logged into, Safari alone continues to
enforce a draconian limit on cookie size.

-- Scott