NativeSPClustering- shared shibd

[Vedran Bartonicek]

Hi,
I have setup clustering so that shibd runs on separate machine, and httpd
with mod_shib on separate machine, using TCP listener plugin.
When shibd is restarted, httpd must also be restarted, otherwise error
appears - like below from :


/var/log/shibboleth-www/native.warn.log
--------------------------------------snip-------------------------------
2016-09-12 08:59:20 ERROR Shibboleth.Listener [24758] shib_handler: error
reading size of output message
2016-09-12 08:59:20 ERROR Shibboleth.Apache [24758] shib_handler: Failure
receiving response to remoted message (default/SAML2/POST).
--------------------------------------snip-------------------------------


and from /var/log/shibboleth-www/
--------------------------------------snip-------------------------------
2016-09-12 09:07:43 DEBUG Shibboleth.Apache [24857] shib_check_user: mapped
https://SC-10-0-221-24.acme.net/helloworld/ to default
2016-09-12 09:07:43 DEBUG Shibboleth.SessionInitiator.SAML2 [24857]
shib_check_user: attempting to initiate session using SAML 2.0 with
provider (https://SC-10-0-221-53.acme.net/idp/shibboleth)
2016-09-12 09:07:43 DEBUG Shibboleth.Listener [24857] shib_check_user:
sending message (default/Login::run::SAML2SI)
2016-09-12 09:07:43 DEBUG Shibboleth.Listener [24857] shib_check_user: send
completed, reading response message
2016-09-12 09:07:43 ERROR Shibboleth.Listener [24857] shib_check_user:
error reading size of output message
2016-09-12 09:07:43 ERROR Shibboleth.Apache [24857] shib_check_user:
Failure receiving response to remoted message (default/Login::run::SAML2SI).
--------------------------------------snip-------------------------------


It looks like httpd tries to reuse dead connections to connect to shibd
(guessing here)

I would appreciate if someone would have idea what to look into to try to
fix this.
Maybe if there is a way to control connection creation policy, someting
like IdP is doing for LDAP connections.

-Vedran Bartonicek
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160912/20839bc3/attachment-0001.html>