F5 monitor for Shib

[Aaron Howell]

Good tip

> Opening up /idp/status to your F5s opens it up to everyone else too.
Only if you are SNATting on the F5s

Cheers,
Aaron

> On 9 Jun 2016, at 5:03 PM, Simon Lundström <simlu at su.se> wrote:
>
> Yet another answer:
>
> Do a GET /idp/ and expect to see "No services are available at this location."
>
> While this doesn't test the actual status of the IDP it does make sure
> that we actually get through the container and to idp.war.
>
> Opening up /idp/status to your F5s opens it up to everyone else too.
> (Well, I guess you can create an iRule to drop those requests or
> configure the F5 to come from another IP when doing the checks, but then
> you'd not actually test the actual IP that your clients will come from
> but another IP and someone could mess up with a firewall rule or
> whatever)
>
> BR,
> - Simon
>
> ____________________________________
>
> Simon Lundström
> Section for Infrastructure
>
> IT Services
> Stockholm University
> SE-106 91 Stockholm, Sweden
>
> www.su.se/english/staff-info/it
>
> On Wed, 2016-06-08 at 15:13:06 +0000, Robert Lamothe wrote:
>> Greetings,
>>     I have 2 shib servers behind my F5.  To get monitoring working I'm using a half HTTP connection which is satisfied so long as the port is open, however I've had failures where HTTP is responsive but shib isn't working.  On a web server I can telnet or openssl to the port and perform a GET / to look for a response, however this doesn't work for shib, does anyone have a suggestion how I can send a test to the shib server to insure it's up and functioning?
>> Thanks-Bob
>> --
>> Bob Lamothe
>> robert_lamothe at yahoo.com
>> KB1BOB
>> 603-918-6336
>>
>
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


Important Notice: The contents of this email are intended solely for the named addressee and are confidential; any unauthorised use, reproduction or storage of the contents is expressly prohibited. If you have received this email in error, please delete it and any attachments immediately and advise the sender by return email or telephone.

Deakin University does not warrant that this email and any attachments are error or virus free.