problems with multiple mod_shib -> single shibd

[Charles Yates]

Shibboleth newbie here, so feel free to tell me to RTFM about this.

We are moving a web application to the Google cloud environment using 
kubernetes.  We are exploring different ways of getting the SAML 
authentication piece working.  (We've been using shibboleth in our 
on-premise environment for quite some time now.)  One approach is to 
have a single node running shibd and having multiple nodes with mod_shib 
configured with <TCPListener> to talk to the single shibd node.  The 
network in the kubernetes is both fast and secure, addressing the issues 
mentioned in the documentation.  One of the reasons for taking this 
approach is that we have found that having session or client IP 
stickiness is not a simple proposition in this environment.

It works fine when there is a single apache node, but with more than 
one, the browser is often redirected back to the idp, often multiple 
times, and more often when there are more apache nodes.  I have debug 
logging enabled and see that mod_shib and shibd are active, but I really 
don't know how to make sense of what I see there. Nothing is logged at 
error level.

Any troubleshooting advice appreciated.

I'll include the pared down apache configuration that I have been using 
(the shibboleth2.xml is essentially what we have been using on-premise 
with the addition of <TCPListener>):

<VirtualHost *:80>
     ServerAdmin **@****.**
     ServerName https://****.***
     DocumentRoot /var/www/html

     <Location /Shibboleth.sso>
         SetHandler shib
     </Location>

     <Location /secure/>
         AuthType shibboleth
         ShibRequestSetting requireSession 1
         Require valid-user
     </Location>

</VirtualHost>

-- 
Charles Yates <ceyates at stanford.edu>
System Software Developer, Stanford School of Medicine