IDP HA -- Why?

[Cantor, Scott]

On 3/9/14, 5:57 AM, "Sam Agnew" <saa2012 at qatar-med.cornell.edu> wrote:

>If my IDP fails over to another IDP that doesn't know anything about the
>sessions my user is still good. Where is the benefit in fiddling with
>Teracotta/memcached to get session retention during failover?

Well, there's a question of stickyness and scaling, but the main reason is
the avoidance of a shared key and very long NameIDs to handle attribute
queries, and handling of the SAML artifact binding.

Logout is also effectively impossible, were it implemented, without shared
state, because the required state doesn't easily fit in a cookie.

-- Scott