IdP clustering without Terracotta?

[Cantor, Scott]

On 3/6/14, 10:36 AM, "Joel Goguen" <joel.goguen at unb.ca> wrote:

>Just to make sure I get this right :) It's the document at
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering
>you're referring to?

Yes.

>If I do that, Shibboleth can still fetch attributes from LDAP/AD and
>Script attributes still work?

I think they're unrelated issues. I don't know of clustering of any kind
that has any impact on attribute resolution except for the issue of
handling SAML attribute query.

>I realized I forgot to mention up front (sorry!) that Shibboleth is the
>authentication source for our ADFS infrastructure. Does that change your
>answer any, or make what I want to accomplish more difficult?

I don't think it's relevant other than just scoping the features the IdP
might need to support, but I don't think that would require supporting
anything in particular that tends to have clustering implications.

In some far future, logout is perhaps relevant in that no purely
client-side clustering approach in future Shibboleth will support single
logout at all. That's about the only thing I know that ADFS claims to
support that has clustering implications.

-- Scott