Stale Request in Clustered Environment

[Aaron Cargo]

Good morning all and greetings from western Pennsylvania;

We're finalizing a Shibboleth 3 deployment to handle campus authentication
for approximately 5000 users. We've a pair of servers running server 2012
behind a load balancer and are using mysql for session storage by setting
the following values in conf/ldap.properties on both machines.

idp.session.StorageService=shibboleth.JPAStorageService
idp.artifact.StorageService = shibboleth.JPAStorageService
idp.replayCache.StorageService = shibboleth.JPAStorageService

Sessions are visible in the mysql database while active and everything
appears to function correctly for either server until the second server is
placed into production on the load balancer.

When we do, users begin receiving "Stale Request" messages when attempting
to authenticate or access a new SP. It doesn't matter which of the two
servers is active behind the load balancer, and it doesn't happen to every
user or for every request. Once a user gets the stale request message, only
dropping one of the idp's from the loadbalancer or an extended wait seems
to resolve the message and allow login, and each new attempt at accessing
the login process seems to refresh the waiting period.

Am I missing something simple or immediately obvious to anyone? If not,
what logging/configuration snippets would be useful in diagnosing this
issue?


Thanks much,
Aaron

Aaron Cargo
*Web Developer / Application Engineer*
Seton Hill University
acargo at setonhill.edu
(724) 552-4386
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151104/c746aaa2/attachment.html>