Shibboleth IdP platform upgrade

[Sharma, Dattathreya]

>Tomcat 7  Client certification validation is not optimal under Tomcat 7.
>It should not be an issue for us, our IdP is fronted by Apache httpd 
>anyway.

>>There's a plugin that works for Tomcat 7, but no, it doesn't matter. 
>>I would note that the Tomcat/Jetty plugins work much better than Apache does. 
>>mod_ssl "optional_no_ca" is broken in a number of ways on various kinds of certificates and 
>>they show no interest in fixing it, so it's not a bad thing to evaluate exposing port 8443 directly from the container even if 443 isn't.

Thanks. I will explore Tomcat/Jetty. We are asking SPs to use front-channel bindings  however we have 100's of SPs and it will be several months before all of them move.

>Clustering - There is no support for Terracotta DSO under Java 7. We 
>have to use an alternate clustering solution or go Stateless which has 
>some features limitations.

>>Yes, that's true. While the implementation won't be the same, using a database via Paul's plugin 
>>will work for V3, and there's also memcache, in addition to the stateless option. 
>>Plus the more creative approaches like Jim's.

>>For cases where single logout isn't needed, I suspect the default solution in V3 will be 
>>stateless because the client-side cookie storage for basic session information has seemed 
>>to work very well. It just can't handle storing references to all the SPs logged into, 
>>Safari alone continues to enforce a draconian limit on cookie size.

We are looking at all options. It is good to where V3 is headed so we can plan accordingly.

Datta

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, February 24, 2014 6:55 AM
To: Shib Users
Subject: Re: Shibboleth IdP platform upgrade

On 2/23/14, 11:20 PM, "Sharma, Dattathreya" <datta at ucla.edu> wrote:

>Tomcat 7  Client certification validation is not optimal under Tomcat 7.
>It should not be an issue for us, our IdP is fronted by Apache httpd 
>anyway.

There's a plugin that works for Tomcat 7, but no, it doesn't matter. I would note that the Tomcat/Jetty plugins work much better than Apache does. mod_ssl "optional_no_ca" is broken in a number of ways on various kinds of certificates and they show no interest in fixing it, so it's not a bad thing to evaluate exposing port 8443 directly from the container even if 443 isn't.

>Clustering - There is no support for Terracotta DSO under Java 7. We 
>have to use an alternate clustering solution or go Stateless which has 
>some features limitations.

Yes, that's true. While the implementation won't be the same, using a database via Paul's plugin will work for V3, and there's also memcache, in addition to the stateless option. Plus the more creative approaches like Jim's.

For cases where single logout isn't needed, I suspect the default solution in V3 will be stateless because the client-side cookie storage for basic session information has seemed to work very well. It just can't handle storing references to all the SPs logged into, Safari alone continues to enforce a draconian limit on cookie size.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net