cas protocol behind an F5

[Niva Agmon]

Marvin, thanks for your reply and for the investigative script. 
It looks like the nodes do connect, but I can only see the ticket on one of the nodes (number 2), even though they are both configured the same:

[np-fim1 ~]$ memdump --servers=localhost
000001570107eb32:_session
000001570107eb8a:ST-1473191079227-9dhAvn7DHDWmSIVoxGATLHU7L

[np-fim1 ~]$ export MEMCACHED_HOSTS="local:11211,remote:11211"
[np-fim1 ~]$ ./memcached-get.sh  000001570107eb8a
Checking local:11211 for 000001570107eb8a
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:11211.
END
Ncat: 21 bytes sent, 5 bytes received in 0.00 seconds.
Checking remote:11211 for 000001570107eb8a
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 10.96.98.11:11211.
VALUE 000001570107eb8a 0 41
https://www.apereo.org/cas/protocol/login
END
Ncat: 21 bytes sent, 77 bytes received in 0.00 seconds.


[np-fim2 ~]$ memdump --servers=localhost
000001570107eb8a
https://www.apereo.org/cas/protocol/login
406c8ef20a0f74111ee2a75a721a4472bb21c1ea1f328d7f438c5c8f55517b3c
000001570107eb32
000001570107eb8a:ST-1473191079081-8Tpt2nN1E8CtyIwsiIfb1nGeJ
000001570107eb8a:ST-1473191078791-c0H5ol1t9g3aO858cpwETgtmy
000001570107eb32:authn/Password
[np-fim2 ~]$ 

[np-fim2 ~]$ export MEMCACHED_HOSTS="local:11211,remote:11211"
[np-fim2 ~]$ ./memcached-get.sh 000001570107eb8a
Checking local:11211 for 000001570107eb8a
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 127.0.0.1:11211.
VALUE 000001570107eb8a 0 41
https://www.apereo.org/cas/protocol/login
END
Ncat: 21 bytes sent, 77 bytes received in 0.00 seconds.
Checking remote:11211 for 000001570107eb8a
Ncat: Version 6.40 ( http://nmap.org/ncat )
Ncat: Connected to 10.96.98.10:11211.
END
Ncat: 21 bytes sent, 5 bytes received in 0.00 seconds.
[np-fim2 ~]$


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of ROGERS Richard M
Sent: Sunday, September 4, 2016 4:58 AM
To: 'Shib Users' <users at shibboleth.net>
Subject: RE: cas protocol behind an F5


On Fri, Sep 02, 2016 at 07:29:19AM +0000, ROGERS Richard M wrote:
> Not an F5, but we're currently going through a migration to Azure, and 
> started off with an Azure load balancer in front of our two IdP v3 
> servers. There were errors due to the whole logon session not being 
> performed on one server (traffic being shared). We've now changed the 
> load balancer to a traffic manager so that there's effectively one 
> live and one "hot standby" server, which seems to be working better.

Azuze load balancing doesn't support sticky sessions? I know F5 does, if that's what's causing the OP's problem. We have three active idp nodes behind a load balancer with no issues, but our load balancer is configured with sticky sessions so any given client is always routed to the same backend server for a given session (modulo that server becoming unavailable of course).

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/ Operating Systems and Network Analyst  |  henson at cpp.edu California State Polytechnic University  |  Pomona CA 91768

-----

Yes, it does, but only per client (which means any back channel requests may not go to the same server, so potential for issues there which we decided to avoid - and we do have memcached running, but my understanding is that this may not be enough for some types of request).

Regards

Richard
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net