IdP management solutions

[Ian Rifkin]

Hi,

I manage the IdP software much like I manage other software at my
organization. I use svn and break it out into a few separate products
(shibboleth, tomcat, shibbolth configuration).

The "shibboleth" product is for housing the actual IdP code. It gets
touched on upgrades and hopefully that's it.

The "Tomcat" product is just the Tomcat files.

The "shibboleth configuration" product is all the metadata, configuration,
etc.

We have a custom release management software to make packages and release
them, but basically it's just a Web UI that makes a tarball from svn and
gives it a build number. Clicking to release just means it will scp
relevant tarball(s) to a server and unpack them.

On release (or you can do with symlinks or the like) it will build
connections between the products -- e.g. Tomcat needs to know about the
idp.war file.

I also have things organized to have shib, apache, and tomcat logs write to
a data directory separate from where they normally would be written (and I
have an instance of Splunk where the prod log data goes too).

That's the basics of how I manage my instance Shibboleth IdP. In terms of
servers I have:

   - 1 dev VM
   - 2 test VMs, load balanced
   - 2 prod VMs, load balanced

Having the servers behind a load balancer means I can restart one at a time
without impacting end users (though unless I tell my systems administrators
to manually point the load balancer at one server the IdP may be down for
~30 seconds for some users before it realizes one of the servers is down).

I hope that helps! Let me know if you have any questions.

Ian

On Tue, Feb 3, 2015 at 1:56 PM, Benjamin Cherian <
benjamin.cherian at villanova.edu> wrote:

> For those that have been using IdP for a while, what solution(s) are you
> using to manage instances of IdP and changed made to the configuration. Do
> you use a VCS like Git or SVN, or another tool like Chef or Ansible? What
> does your setup look like how does your deployment process look like?
>
> Currently we're looking to setup a load balanced solution with 2 IdP
> servers in both dev and production. We want a solid solution for managing
> when we add new RPs, change attribute filters, and make other
> configuration changes.
>
> Thanks,
> Ben Cherian
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Ian Rifkin '04, MS '09
Software Systems Manager
Library and Technology Services (LTS)
Brandeis University

http://go.brandeis.edu/u:irifkin
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150203/852de873/attachment.html