problems with multiple mod_shib -> single shibd

[Cantor, Scott]

On 11/7/16 7:21 PM, Charles Yates wrote:
> 
> We are moving a web application to the Google cloud environment using
> kubernetes.

Obviously the SP is very much designed for a different environment, I
don't think about the world the way these cloud platforms do, and I
didn't design software around them. Anything you do here is at best a
kluge. I wish there were better non-PHP options with mature SAML
support, but unfortunately...

> We are exploring different ways of getting the SAML
> authentication piece working.  (We've been using shibboleth in our
> on-premise environment for quite some time now.)  One approach is to
> have a single node running shibd and having multiple nodes with mod_shib
> configured with <TCPListener> to talk to the single shibd node.  The
> network in the kubernetes is both fast and secure, addressing the issues
> mentioned in the documentation.

Unless it's localhost, it's not fast enough. If you have any scale at
all, it will fall over. The rest is really academic.

If you're comfortable with databases or memcache, that would be the
option to look at, but I would still have to ask the usual
question...how are you clustering the app to start with? Just do that
and leave the SP session out of it.

> One of the reasons for taking this
> approach is that we have found that having session or client IP
> stickiness is not a simple proposition in this environment.

You have to though. If you're trying to use the SP to address lack of
clustering support in the app layer, I have to say that's a cart before
horse situation. The SP is never going to be as mature for that as the
application framework should already be.

> It works fine when there is a single apache node, but with more than
> one, the browser is often redirected back to the idp, often multiple
> times, and more often when there are more apache nodes.

If that's the case, then it's not using a common shibd or something else
is invalidating the sessions, or you have fundamental errors in your
load balancing that are causing cookies to be dropped.

-- Scott