***UNCHECKED*** Re: Problem with SOAP call to 2.4.4 IdP / port 8443 / F5 load balancer

[Cantor, Scott]

On 11/12/15, 11:18 PM, "users on behalf of Benji Wakely" <users-bounces at shibboleth.net on behalf of B.Wakely at latrobe.edu.au> wrote:


>Sorry for the conflation of the two terms- they started out confused for me.
>I was considering the memcache option to be the one to go for.

Quite possibly your best choice (well, aside from just upgrading to v3, and then you don't really have as much of a problem, most of those features work or will work soon even without server state).

>For _this_ particular SP, I _believe_ all I need to do is maintain the _Attribute Query_
>functionality, so the CryptoTransient method that you and Chris outline is excellent,
>and gives me much hope.

You mean IdP? You obviously have to support the features required by all of your SPs, not just one. And for the record, you should only need query support if you have to support SAML 1 SPs and don't just push them the attributes. Or you're doing something unusual involving standalone queries for some application.

>This would leave me (according to https://wiki.shibboleth.net/confluence/display/SHIB2/IdPStatelessClustering)
>dropping the features:
>
>	Artifact Bindings
>	Single Logout
>	Replay Detection
>	Single Sign-on

Well, the latter is obviously huge. That really depends how you're doing your logins. The approach there for V2 depends on using additional custom code for SSO, or using something like CAS or pubcookie or whatever to do the authentication separately.

The origin of all that code is really OSU's deployment, and we use a custom login handler that handles the SSO. But the code that was donated back to the project just handles the attribute query issue (because back then, SAML 1 was still a going concern).

>Re: Artifact Bindings:
>	I've checked our apache logs, I can't see that any SPs are actually hitting our Artifact Binding endpoint.

If you're not using it, you really should make sure you're not publishing it in your metadata. Never publish features you aren't using in the metadata; it avoids significant problems.


>	Reading:
>		http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf
>	I Think the flow of data with artefact resolution mandates that an SP that does this Must 
>	hit our endpoint, so our apache logs would faithfully let us know if anyone is/is not 
>	using the feature, yes?

Yes.

-- Scott