IdP clustering without Terracotta?

[Joel Goguen]

I need to work with Java7, so no Terracotta for me. Which seems to be causing more problems than it helps solve, so maybe I'll see if I can work with Java6 instead and somehow split Shibboleth off onto its own Tomcat instance. We're using Tomcat 6 and IdP 2.4 so if I can use Java 6 I may come back and hit you up for Terracotta.

--
Joel Goguen
Developer
Enterprise Solutions
Information Technology Services
University of New Brunswick
Email: joel.goguen at unb.ca<mailto:joel.goguen at unb.ca>
Phone: (506) 453-4872
Fax: (506) 453-3590

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Jeffrey Crawford
Sent: 06 March 2014 13:17
To: Shib Users
Subject: Re: IdP clustering without Terracotta?

If you are wanting to use Terrracotta I have a copy of version 3.5.2 which works with Shibboleth IdP's v 2.4 java 1.6 and tomcat 6. (We had problems with tomcat 7 and java 1.7)

The classic instructions still work. Not sure if you question was related to not being able to find terracotta or not

Jeffrey E. Crawford

On Thu, Mar 6, 2014 at 7:55 AM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
On 3/6/14, 10:36 AM, "Joel Goguen" <joel.goguen at unb.ca<mailto:joel.goguen at unb.ca>> wrote:

>Just to make sure I get this right :) It's the document at
>https://wiki.shibboleth.net/confluence/display/SHIB2/IdPProxyClustering
>you're referring to?
Yes.

>If I do that, Shibboleth can still fetch attributes from LDAP/AD and
>Script attributes still work?
I think they're unrelated issues. I don't know of clustering of any kind
that has any impact on attribute resolution except for the issue of
handling SAML attribute query.

>I realized I forgot to mention up front (sorry!) that Shibboleth is the
>authentication source for our ADFS infrastructure. Does that change your
>answer any, or make what I want to accomplish more difficult?
I don't think it's relevant other than just scoping the features the IdP
might need to support, but I don't think that would require supporting
anything in particular that tends to have clustering implications.

In some far future, logout is perhaps relevant in that no purely
client-side clustering approach in future Shibboleth will support single
logout at all. That's about the only thing I know that ADFS claims to
support that has clustering implications.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140306/05e8557a/attachment.html