NativeSPClustering- shared shibd

[Vedran Bartonicek]

Forgot to add:
shibboleth-2.5.5-3.1.el6.x86_64
httpd-2.2.15-54.el6_8.x86_64


On 12 September 2016 at 09:12, Vedran Bartonicek <vbartoni at gmail.com> wrote:

> Hi,
> I have setup clustering so that shibd runs on separate machine, and httpd
> with mod_shib on separate machine, using TCP listener plugin.
> When shibd is restarted, httpd must also be restarted, otherwise error
> appears - like below from :
>
>
> /var/log/shibboleth-www/native.warn.log
> --------------------------------------snip-------------------------------
> 2016-09-12 08:59:20 ERROR Shibboleth.Listener [24758] shib_handler: error
> reading size of output message
> 2016-09-12 08:59:20 ERROR Shibboleth.Apache [24758] shib_handler: Failure
> receiving response to remoted message (default/SAML2/POST).
> --------------------------------------snip-------------------------------
>
>
> and from /var/log/shibboleth-www/
> --------------------------------------snip-------------------------------
> 2016-09-12 09:07:43 DEBUG Shibboleth.Apache [24857] shib_check_user:
> mapped https://SC-10-0-221-24.acme.net/helloworld/ to default
> 2016-09-12 09:07:43 DEBUG Shibboleth.SessionInitiator.SAML2 [24857]
> shib_check_user: attempting to initiate session using SAML 2.0 with
> provider (https://SC-10-0-221-53.acme.net/idp/shibboleth)
> 2016-09-12 09:07:43 DEBUG Shibboleth.Listener [24857] shib_check_user:
> sending message (default/Login::run::SAML2SI)
> 2016-09-12 09:07:43 DEBUG Shibboleth.Listener [24857] shib_check_user:
> send completed, reading response message
> 2016-09-12 09:07:43 ERROR Shibboleth.Listener [24857] shib_check_user:
> error reading size of output message
> 2016-09-12 09:07:43 ERROR Shibboleth.Apache [24857] shib_check_user:
> Failure receiving response to remoted message (default/Login::run::SAML2SI).
> --------------------------------------snip-------------------------------
>
>
> It looks like httpd tries to reuse dead connections to connect to shibd
> (guessing here)
>
> I would appreciate if someone would have idea what to look into to try to
> fix this.
> Maybe if there is a way to control connection creation policy, someting
> like IdP is doing for LDAP connections.
>
> -Vedran Bartonicek
>
>
>
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160912/fda19aa5/attachment.html>