IDP 3 clustering

[Peter Schober]

* Hong Ye <hy93 at cornell.edu> [2015-06-25 17:58]:
> Thank you for your reply. Does that mean SAML1 Attribute query is
> not associated with user’s authentication session since user’s
> authentication might be on IDP server 1 and later one attribute
> query might be sent to server 2?

It's not associated with a user session per se, but practically will
be, because of the likely use of transient NameIDs to query for
attributes.

In IDPv2 avoiding shared state could be avoided by using alternative
NameID (really: attribute) definitions and "principal connectors",
plus a shared key between all IDP
nodes. cf. https://wiki.shibboleth.net/confluence/display/SHIB2/IdPStatelessClustering

I'm sure this has been brought forward to IDPv3, not sure it's
documented yet, though.
-peter