Clustering the SP

[Martin Haase]

Hi Scott,

thanks for this one. No, we had not reported the bug yet to Ubuntu, but
looks like we're forced to now. The application (moodle) ist clustered
via some mySQL DBs and an haProxy on each machine. There's another
CGI-based application clustered via shared NFS. Both of them are
protected by the SP. As far as I can see, Apache worker is not an
option, it's PHP again, where worker is (at least used to be, we'd have
to check) not thread safe.

What about the idea I mentioned, a failover via the TCPListener, do you
see this is an option?
> * C) Shared shibd. Problem: single point of failure. What about
> inserting a proxy before the TCPListener, did anybody implement a
> failover shibd with active-passive, and how?
Cheers,
Martin

Am 21.01.2014 16:09, schrieb Cantor, Scott:
> On 1/21/14, 7:54 AM, "Martin Haase" <Martin.Haase at DAASI.de> wrote:
>> I'd like your thoughts regarding SP clustering.
> I'd start by questioning how you cluster the application itself.
>
>> * A) ODBC/MySQL clustering. Fails under high load:
>> https://issues.shibboleth.net/jira/browse/SSPCPP-602
> Have you reported the bug to Ubuntu? Presumably with a stack trace they
> should be able to look into it. I also noted that you should verify you're
> not using prefork.
>
>> * C) Shared shibd. Problem: single point of failure. What about
>> inserting a proxy before the TCPListener, did anybody implement a
>> failover shibd with active-passive, and how?
> memcache is also a single point of failure, but the major problem with
> that is performance. I know for a fact it doesn't scale, nor was it meant
> to.
>
>> * D) Our SLO is front-channel. What about forgetting the SP session and
>> relying on session stickyness by the LB?
> Most applications don't cluster well, and require sticky sessions. In such
> cases, it doesn't matter much if the SP also does. But I would say that
> your main issue is a broken ODBC driver.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Dr. Martin Haase, Solutions Engineer

DAASI International GmbH        
Europaplatz 3                   
D-72072 Tübingen                
Germany                    

phone: +49 7071 407109-6
fax:   +49 7071 407109-9  
email: martin.haase at daasi.de
web:   www.daasi.de

Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 2345 bytes
Desc: S/MIME Cryptographic Signature
Url : http://shibboleth.net/pipermail/users/attachments/20140122/86b27f1c/attachment.bin