DataSealer dependencies

[Paul B. Henson]

On Wed, Mar 09, 2016 at 02:06:52PM -0800, Andrew Morgan wrote:

> We intend to start using memcache soon to support the CAS protocol in 
> Shibboleth.  We are also looking to distribute our IDP nodes on various 
> networks, including out in the cloud.  Is there any sensitive information 
> stored in the IDP session?  Should we be concerned about the cleartext 
> connection from the IDP to memcache?

I've been using Unicon's hazelcast ticketregistry implementation with
CAS server with great success. I like it better than memcache as it's
fault tolerant and survives loss of a node without losing tickets. It
also has built-in encryption for on the wire transfer, although I found
that unreliable and ended up setting up ipsec tunnels between my nodes
to secure the node replication traffic. Unicon also has a hazelcast
storage backend for the idp, I haven't had a chance to try it yet but
it's the next thing on my list as I'm working on our idpv3 upgrade.
We're planning on migrating all of our CAS clients to the built-in CAS
support in idpv3 as well, I'm hoping their idp hazelcast implementation
works as well for me as their CAS server one has been.


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768