IdP3 Clustering...

[Cantor, Scott]

On 11/30/16, 8:53 AM, "users on behalf of Marc SAHIN" <users-bounces at shibboleth.net on behalf of marc.sahin at univ-lyon2.fr> wrote:

> Is it by default like that or do I have to configure the client side session storage ?

It comes by default that way, but you have to turn on HTML storage if you want to use that in addition to cookies.

> If I'm not mistaken, in case of IdP failure, the user will be prompted to sign in again, is there another constraint?

Client storage survives IdP restarts. Anything but in-memory survives restarts, mostly.

>    I’ve found some recommendations for storage entity, are you an objection or another suggestion about that
> for an IdP3 cluster active-active?

I don't read HTML email.

> According to the documentation, I have to configure global.xml to save PersistentID and User consents into the
> database and idp.properties for SAML artifacts.

If you want to use a database, you need a data source and the documentation describes various techniques for defining and supplying it.

>  However, is it enough to configure JPAStorageService to save all three of them in db ?

You don't need multiple databases if that's what you're asking. You can share one storage service across all the use cases if you choose.

>    Does the database replication has to be master-master ?

There is usually no such thing as master-master, short of paying millions of dollars to Oracle. Databases are generally a single point of failure, or at least some kind of active/passive configuration. From the Storage plugin's perspective, 

>    Is there any limitation for in using SELinux for IdP3 ?

No idea.

-- Scott