Problem with SOAP call to 2.4.4 IdP / port 8443 / F5 load balancer

[Benji Wakely]

> On 11/11/2015 10:28 PM, Brent Putman wrote:
> > On 11/11/15 10:57 PM, Benji Wakely wrote:
> >> On 13/11/2015 02:34 AM, Christopher Bongaarts wrote:
> >> 	- Not possible to Simply load balance this and keep Attribute Query
> functionality.
> >
> > Well, you referenced the IdPStatelessClustering page below.  That has
> > a pointer to how to do stateless clustering with support for attribute
> > query using the -CryptoTransient- components (see bottom of that
> > page).  If all you need to support is attribute query, that's probably
> > the preferred and easiest solution.

Thank you both for your response.

...I misspoke, sorry. 
"Artifact Binding" and "Attribute Query" got conflated.
Sorry for the conflation of the two terms- they started out confused for me.
I was considering the memcache option to be the one to go for.

For _this_ particular SP, I _believe_ all I need to do is maintain the _Attribute Query_
functionality, so the CryptoTransient method that you and Chris outline is excellent,
and gives me much hope.

This would leave me (according to https://wiki.shibboleth.net/confluence/display/SHIB2/IdPStatelessClustering)
dropping the features:

	Artifact Bindings
	Single Logout
	Replay Detection
	Single Sign-on 

In exchange for HA clustering ability supportive of Attribute Queries using Transient IDs.

Re: Artifact Bindings:
	I've checked our apache logs, I can't see that any SPs are actually hitting our Artifact Binding endpoint.

	Reading:
		http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf
	I Think the flow of data with artefact resolution mandates that an SP that does this Must 
	hit our endpoint, so our apache logs would faithfully let us know if anyone is/is not 
	using the feature, yes?

The other features I've read through and I'll take it up with folks here about how essential or not they are.


> Indeed, we use the crypto transients with our IdP behind an F5 LTM to much
> success, even for our one SP that actually uses attribute query.
> 
> FWIW, we are using a standard virtual server for both front and back channel,
> not the L4 performance ones.

	FWIW: it's always worth a lot to hear of confirmed and working setups.
	:)

--Benji