IDP node stickiness without an SLB?

[Takeshi NISHIMURA]

> I'm pretty sure that you only really need to sticky that page (because 
> the login context stored locally to that IdP server).

There is another round trip to /idp/profile/SAML2/Redirect/SSO (or something like that).

If you are using Apache in front of Tomcat, you can rewrite all the destination
URLs of redirection/POST using the following configuration.

(snip)
-ServerName idp.example.ac.jp:443
+ServerName 1.idp.example.ac.jp:443
+UseCanonicalName On
(snip)
 ProxyPass /idp ajp://localhost:8009/idp
+ProxyPassReverse /idp/ https://idp.example.ac.jp:443/idp/
(snip)

Detailed description is written in:
https://meatwiki.nii.ac.jp/confluence/display/GakuNinShare/IdPClusteringStickyLogin
, though in Japanese. 

Regards,
Takeshi


2014/01/22 6:38、Christopher Bongaarts <cab at umn.edu>：

> On 1/21/2014 4:21 PM, Wessel, Keith wrote:
>> Can anyone make any suggestions of how we might, once a user hits node 
>> 1 or node 2, keep them going back to that node until they’re logged in 
>> and returning to the SP? I see no easy way to, say, put an absolute 
>> URL in place of /idp for all of the relative URLs presented by the IDP.
> 
> Off the top of my head - not sure if this would actually work:
> 
> Update the login.jsp to look at the Host: header - if it's the "virtual" 
> name (idp.illinois.edu), redirect to one of the "real" names 
> (idpN.illinois.edu). Otherwise leave it alone.
> 
> I'm pretty sure that you only really need to sticky that page (because 
> the login context stored locally to that IdP server).
> 
> -- 
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%