Our clustering solution for IdP v3

[Cantor, Scott]

> That's going to simplify things a lot for us then and we can treat SAML1
> the same as SAML2 and distribute it across the 3 nodes (albeit with
> session stickiness to ensure that we don't switch nodes mid conversation).

You could also, in most cases, just push attributes and avoid the query entirely. I'm doing that to get V3 rolled out without a back channel, but then I only had a handful of SAML 1 SPs to deal with, so I had an easier time of it.

If you don't have a back channel, there are advantages to switching the transient generation back to "random", simply to keep them shorter, which also makes the client-side session cache *much* smaller if you're tracking SPs and supporting logout (or what passes for it).

-- Scott