multiple sp hosts behind a firewall/proxy etc

[Musil, William]

Solved.

The stick at the load balance layer was being set to the application’s jsession. Since we don’t require stick as the backend handles the session management, I didn’t realize that there was nothing in the cookie at the beginning as the application only sets the jsession on login. When there was only one path, it worked, but hardly worked when more than one member was behind the balancer. The balancer was reconfigured to stick based on it’s own balance routes instead of the application jsession and now the clustered SPs are talking to testshib just fine and forwarding users into the application.

Thanks again Scott for all your help.

________________________________

William T. Musil
Manager, Technical Services

LABVANTAGE Solutions, Inc.
265 Davidson Avenue, Suite 220
Somerset, NJ 08873-4120 USA

Phone: 908-333-0111
Mobile: 908-531-0835
Fax: 732-560-0121
Email: wmusil at labvantage.com<mailto:wmusil at labvantage.com?subject=Link%20from%20Signature>
Website: www.labvantage.com<http://www.labvantage.com>
Skype: bmusil.lvs<skype:bmusil.lvs?chat>

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Musil, William
Sent: Sunday, May 31, 2015 4:47 PM
To: Cantor, Scott; Shib Users
Subject: RE: multiple sp hosts behind a firewall/proxy etc

Ok thanks.

Now that I have a short term way to make it appear to work as it should, while allowing end users to do application funtional testing with the jboss cluster active, I can setup captures along the path, then activate the additional nodes temporarily for the captures, get the data, and then idle the redundant shibd and httpd till I work out what is wrong.

I'll give that a shot.

Sent from my Verizon Wireless 4G LTE smartphone


-------- Original message --------
From: "Cantor, Scott" <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>>
Date: 05/31/2015 14:03 (GMT-05:00)
To: "Musil, William" <wmusil at labvantage.com<mailto:wmusil at labvantage.com>>, Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: multiple sp hosts behind a firewall/proxy etc
On 5/30/15, 11:03 PM, "Musil, William" <wmusil at labvantage.com<mailto:wmusil at labvantage.com>> wrote:
>
>Any ideas from anyone are welcome.

You need to check all the logs to determine if the cookie is being sent but not accepted, and run traces to see if the cookie's just not being sent.

There's no way from outside a system to determine the cause of a loop.

If it's sporadic, then that means the configuration itself is probably intrinsically ok, but that you have a per-transaction influence. Off-hand that leaves a lack of stickiness, which you claim isn't the case, or IP addresses changing and invalidating sessions, which would be logged.

-- Scott
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150615/b8b42603/attachment-0001.html>