F5 monitor for Shib

[Simon Lundström]

Yet another answer:

Do a GET /idp/ and expect to see "No services are available at this location."

While this doesn't test the actual status of the IDP it does make sure
that we actually get through the container and to idp.war.

Opening up /idp/status to your F5s opens it up to everyone else too.
(Well, I guess you can create an iRule to drop those requests or
configure the F5 to come from another IP when doing the checks, but then
you'd not actually test the actual IP that your clients will come from
but another IP and someone could mess up with a firewall rule or
whatever)

BR,
- Simon

____________________________________

Simon Lundström
Section for Infrastructure

IT Services
Stockholm University
SE-106 91 Stockholm, Sweden

www.su.se/english/staff-info/it

On Wed, 2016-06-08 at 15:13:06 +0000, Robert Lamothe wrote:
> Greetings,
>     I have 2 shib servers behind my F5.  To get monitoring working I'm using a half HTTP connection which is satisfied so long as the port is open, however I've had failures where HTTP is responsive but shib isn't working.  On a web server I can telnet or openssl to the port and perform a GET / to look for a response, however this doesn't work for shib, does anyone have a suggestion how I can send a test to the shib server to insure it's up and functioning?
> Thanks-Bob
> --
> Bob Lamothe
> robert_lamothe at yahoo.com
> KB1BOB
> 603-918-6336
> 

> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net