cas protocol behind an F5

[ROGERS Richard M]

Not an F5, but we're currently going through a migration to Azure, and started off with an Azure load balancer in front of our two IdP v3 servers. There were errors due to the whole logon session not being performed on one server (traffic being shared). We've now changed the load balancer to a traffic manager so that there's effectively one live and one "hot standby" server, which seems to be working better. (This arrangement should also ensure that back channel traffic goes to the same server, though this is not yet tested). I think you could achieve something similar with your F5.

Hope this helps.

Regards

Richard

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Niva Agmon
Sent: 02 September 2016 01:52
To: Shib Users <users at shibboleth.net>
Subject: cas protocol behind an F5


Our CAS protocol users started getting errors and failing since we put our two idp nodes behind an F5 load balancer. Our setup is: two v3.2.1 idp nodes behind an F5 load balancer, using memcached for session & cas storage.

Does anyone have a similar setup that is working for them with CAS protocol and memcached behind an F5?

This is from the Cas Client server:
[Fri Aug 26 12:01:45.310071 2016] [:debug] [pid 63216] mod_auth_cas.c(1442): [client 155.247.87.98:52582] MOD_AUTH_CAS: response = <?xml version="1.0" encoding="UTF-8"?>\n<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/"><SOAP-ENV:Body><saml1p:Response IssueInstant="2016-08-26T16:01:45.263Z" MajorVersion="1" MinorVersion="1" ResponseID="ST-1472227304672-dq7cqqPmq8RYKYavChqbAiysK" xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode Value="INVALID_TICKET" xmlns="http://www.ja-sig.org/products/cas/"/><saml1p:StatusMessage>E_TICKET_EXPIRED</saml1p:StatusMessage></saml1p:Status></saml1p:Response></SOAP-ENV:Body></SOAP-ENV:Envelope>, referer: https://xxxx.temple.edu/..../

Any tips, ideas, suggestions will be highly appreciated!

Thanks,
Niva

Temple University
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160902/68ca7dec/attachment-0001.html>