CAS protocol and memcached storage in HA configuration

[Scott Koranda]

Hi,

I am using IdP version 3.1.1.

I have deployed memcached version 1.4.24 and configured the
IdP to use it for storage for sessions and for CAS.
Specifically I have set

idp.session.StorageService = shibboleth.MemcachedStorageService
idp.cas.StorageService = shibboleth.MemcachedStorageService

The global.xml configuration is as detailed in the wiki at

https://wiki.shibboleth.net/confluence/display/IDP30/Storage

I have two (2) nodes. IP address entries for both appear in
the global.xml configuration.

I have confirmed the CAS flow works when both the browser and
the CAS client hit the same node (either node, as long as both
browser and CAS client hit the same node).

When I force the browser and CAS client to hit different
nodes, however, the node the CAS client is hitting to validate
the ticket logs

2015-06-18 16:01:00,844 - DEBUG
[net.shibboleth.idp.cas.ticket.SimpleTicketService:225] -
ST-1434668460354-LpOmMQiqBQtY4ydzvgaW1QAWo not found in
context https://www.apereo.org/cas/protocol/login

When I run memcached with the -vv option I see the node the
browser is hitting output this (minus the actual binary data):

<37 Read binary protocol data:
<37 GET 5edb2ae914ac4ea5dc74f9d510a79468a23f30c5742e84bca7d2915c7e578152
>37 Writing an error: Not found
>37 Writing bin response:
<37 Read binary protocol data:
<37 ADD 5edb2ae914ac4ea5dc74f9d510a79468a23f30c5742e84bca7d2915c7e578152 Value len is 16
>37 Writing bin response:
<37 Read binary protocol data:
<37 ADD 0000014e08edeb53:_session Value len is 65
>37 Writing bin response:
<37 Read binary protocol data:
<37 GET 5edb2ae914ac4ea5dc74f9d510a79468a23f30c5742e84bca7d2915c7e578152
>37 Writing bin response:
<37 Read binary protocol data:
<37 ADD 0000014e08edeb53:authn/Password Value len is 317
>37 Writing bin response:
<37 Read binary protocol data:
<37 GET 5edb2ae914ac4ea5dc74f9d510a79468a23f30c5742e84bca7d2915c7e578152
>37 Writing bin response:
<37 Read binary protocol data:
<37 SET 0000014e08edeb53:_session Value len is 92
CAS:  failure: expected 21, got 1
>37 Writing an error: Data exists for key.
>37 Writing bin response:
<37 Read binary protocol data:
<37 GET 5edb2ae914ac4ea5dc74f9d510a79468a23f30c5742e84bca7d2915c7e578152
>37 Writing bin response:
<37 Read binary protocol data:
<37 GET 0000014e08edeb53:_session
>37 Writing bin response:
<37 Read binary protocol data:
<37 GET 5edb2ae914ac4ea5dc74f9d510a79468a23f30c5742e84bca7d2915c7e578152
>37 Writing bin response:
<37 Read binary protocol data:
<37 SET 0000014e08edeb53:_session Value len is 92
>37 Writing bin response:
<37 Read binary protocol data:
<37 GET 0000014e08edeb53:_session
>37 Writing bin response:

The node that the CAS client is hitting outputs this:

<37 Read binary protocol data:
<37 ADD 0000014e08edeb53 Value len is 64
>37 Writing bin response:

Should the node the CAS client is hitting have been able to
find the service ticket, or am I misunderstanding the
memcached storage implementation?

Note that I did not change the storage implemenation for the
replay cache or the artifact cache--does that matter?

Thanks,

Scott K