problems with multiple mod_shib -> single shibd

[Charles Yates]

Thanks Scott, for gracefully saying its not gonna work :-)

A colleague is looking into a ODBC StorageService, so we may more 
questions for you about that.

We do have the back end (tomcat) in a multiple node cluster with the 
sessions stored in a shared redis cache.  No stickiness required.

-Charles

On 11/7/16 4:36 PM, Cantor, Scott wrote:
> On 11/7/16 7:21 PM, Charles Yates wrote:
>> We are moving a web application to the Google cloud environment using
>> kubernetes.
> Obviously the SP is very much designed for a different environment, I
> don't think about the world the way these cloud platforms do, and I
> didn't design software around them. Anything you do here is at best a
> kluge. I wish there were better non-PHP options with mature SAML
> support, but unfortunately...
>
>> We are exploring different ways of getting the SAML
>> authentication piece working.  (We've been using shibboleth in our
>> on-premise environment for quite some time now.)  One approach is to
>> have a single node running shibd and having multiple nodes with mod_shib
>> configured with <TCPListener> to talk to the single shibd node.  The
>> network in the kubernetes is both fast and secure, addressing the issues
>> mentioned in the documentation.
> Unless it's localhost, it's not fast enough. If you have any scale at
> all, it will fall over. The rest is really academic.
>
> If you're comfortable with databases or memcache, that would be the
> option to look at, but I would still have to ask the usual
> question...how are you clustering the app to start with? Just do that
> and leave the SP session out of it.
>
>> One of the reasons for taking this
>> approach is that we have found that having session or client IP
>> stickiness is not a simple proposition in this environment.
> You have to though. If you're trying to use the SP to address lack of
> clustering support in the app layer, I have to say that's a cart before
> horse situation. The SP is never going to be as mature for that as the
> application framework should already be.
>
>> It works fine when there is a single apache node, but with more than
>> one, the browser is often redirected back to the idp, often multiple
>> times, and more often when there are more apache nodes.
> If that's the case, then it's not using a common shibd or something else
> is invalidating the sessions, or you have fundamental errors in your
> load balancing that are causing cookies to be dropped.
>
> -- Scott
>


-- 
Charles Yates <ceyates at stanford.edu>
System Software Developer, Stanford School of Medicine