IdP3 Clustering...

[Marc SAHIN]

Thank you for your reply, it's more clear now.
> /I’ve found some recommendations for storage entity, are you an 
> objection or another suggestion about that for an IdP3 cluster 
> active-active? /
//

/I don't read HTML email. /

Ref : 
https://www.switch.ch/aai/support/presentations/shibboleth-training-2015/T3P12-Clustering-IdPs.pdf 
(p3)

>    /Does the database replication has to be master-master ? /
//

/There is usually no such thing as master-master, short of paying 
millions of dollars to Oracle. Databases are generally a single point of 
failure, or at least some kind of active/passive configuration. From the 
Storage plugin's perspective, /

We have two sites so we need one IdP and one db server(like Mysql) in each site in order to ensure BCP.
Both IdP will be actives on production, if the database replication can be master-slave, a user might have two different Persistent ID...etc until the replication(master will also overwrite dta in slave...) so doesn't it cause data loss or any dysfunction ?

Lastly, are the IdP's entities confidential ? I mean that should we put in place a mechanism to protect the data some kind of db replication with ssl ?

Marc SAHIN

Administrateur Systèmes
Pôle Système  - DSI - Université Lumière Lyon 2
04 78 77 26 66

On 30/11/2016 16:04, Cantor, Scott wrote:
> On 11/30/16, 8:53 AM, "users on behalf of Marc SAHIN" <users-bounces at shibboleth.net on behalf of marc.sahin at univ-lyon2.fr> wrote:
>
>> Is it by default like that or do I have to configure the client side session storage ?
> It comes by default that way, but you have to turn on HTML storage if you want to use that in addition to cookies.
>
>> If I'm not mistaken, in case of IdP failure, the user will be prompted to sign in again, is there another constraint?
> Client storage survives IdP restarts. Anything but in-memory survives restarts, mostly.
>
>>     I’ve found some recommendations for storage entity, are you an objection or another suggestion about that
>> for an IdP3 cluster active-active?
> I don't read HTML email.
>
>> According to the documentation, I have to configure global.xml to save PersistentID and User consents into the
>> database and idp.properties for SAML artifacts.
> If you want to use a database, you need a data source and the documentation describes various techniques for defining and supplying it.
>
>>   However, is it enough to configure JPAStorageService to save all three of them in db ?
> You don't need multiple databases if that's what you're asking. You can share one storage service across all the use cases if you choose.
>
>>     Does the database replication has to be master-master ?
> There is usually no such thing as master-master, short of paying millions of dollars to Oracle. Databases are generally a single point of failure, or at least some kind of active/passive configuration. From the Storage plugin's perspective,
>
>>     Is there any limitation for in using SELinux for IdP3 ?
> No idea.
>
> -- Scott
>
>      
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161130/f336132e/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ajklmfcojikjhmjg.png
Type: image/png
Size: 6616 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20161130/f336132e/attachment.png>