cas protocol behind an F5

[Paul B. Henson]

On Mon, Sep 12, 2016 at 08:17:05PM +0000, Niva Agmon wrote:
> Still seeing the exception errors when recycling the IDP.

I don't recall ever seeing those errors. Here's the config I'm using,
the main differences seem to be that I have port auto increment disabled
and I'm using the default hazelcast.max.no.heartbeat.seconds of 300. 5
is a bit tight, I know that's the default in the config in the example,
but you might try increasing that a bit and seeing if maybe that's
causing an issue? Depending on how long your container is taking to shut
down could be a node is getting kicked out before it can gracefully
exit.

    <hz:hazelcast id="hazelcast">
        <hz:config>
            <hz:properties>
                <hz:property name="hazelcast.logging.type">slf4j</hz:property>
            </hz:properties>
            <hz:network port="5701" port-auto-increment="false">
                <hz:join>
                    <hz:multicast enabled="false"/>
                    <hz:tcp-ip enabled="true">
                        <hz:members>__IDP_NODE1__, __IDP_NODE2__, __IDP_NODE3__</hz:members>
                    </hz:tcp-ip>
                </hz:join>
                <hz:reuse-address>true</hz:reuse-address>
            </hz:network>
            <hz:map name="sso_session"
                    max-size-policy="USED_HEAP_PERCENTAGE"
                    max-size="50"
                    eviction-policy="LRU"
                    eviction-percentage="5"/>
            <hz:map name="replay_cache"
                    backup-count="0"
                    max-size-policy="USED_HEAP_PERCENTAGE"
                    max-size="5"
                    eviction-policy="LRU"
                    eviction-percentage="5"/>
            <hz:map name="cas_tickets"
                    read-backup-data="true"
                    max-size-policy="USED_HEAP_PERCENTAGE"
                    max-size="10"
                    eviction-policy="LRU"
                    eviction-percentage="5"/>
        </hz:config>
    </hz:hazelcast>

    <bean id="edu.cpp.ssoHazelcastStorageService"
          class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
        <constructor-arg name="mapName" value="sso_session" />
        <constructor-arg name="hazelcastInstance" ref="hazelcast" />
    </bean>

    <bean id="edu.cpp.replayHazelcastStorageService"
          class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
        <constructor-arg name="mapName" value="replay_cache" />
        <constructor-arg name="hazelcastInstance" ref="hazelcast" />
    </bean>

    <bean id="edu.cpp.casHazelcastStorageService"
          class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
        <constructor-arg name="mapName" value="cas_tickets" />
        <constructor-arg name="hazelcastInstance" ref="hazelcast" />
    </bean>

> This is our Hazelcast configuration:
> 
> <!-- Hazelcast storage configuration --> <bean id="hazelcast" class="com.hazelcast.core.Hazelcast" factory-method="newHazelcastInstance">
>     <constructor-arg name="config">
>         <bean class="com.hazelcast.config.Config">
>             <property name="properties">
>                 <util:properties>
>                     <prop key="hazelcast.logging.type">slf4j</prop>
>                     <prop key="hazelcast.max.no.heartbeat.seconds">5</prop>
>                 </util:properties>
>             </property>
>             <property name="networkConfig">
>                 <bean class="com.hazelcast.config.NetworkConfig">
>                     <property name="port" value="5701"/>
>                     <property name="portAutoIncrement" value="true"/>
>                     <property name="join" ref="tcpIpHazelcastJoinConfig"/>
>                 </bean>
>             </property>
>         </bean>
>     </constructor-arg>
> </bean>
> 
> <bean id="tcpIpHazelcastJoinConfig" class="com.hazelcast.config.JoinConfig">
>     <property name="multicastConfig">
>         <bean class="com.hazelcast.config.MulticastConfig">
>             <property name="enabled" value="false"/>
>         </bean>
>     </property>
>     <property name="tcpIpConfig">
>         <bean class="com.hazelcast.config.TcpIpConfig">
>             <property name="enabled" value="true"/>
>             <property name="members" value="%{hz.cluster.members:--shib_node1----,---shib_node2---}"/>
>         </bean>
>     </property>
> </bean>
> 
> <bean id="my.HazelcastStorageService"
>       class="net.unicon.iam.shibboleth.storage.HazelcastMapBackedStorageService">
>     <constructor-arg name="hazelcastInstance" ref="hazelcast" /> </bean>
> 
> <bean id="my.StorageService.cas"
>         class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
>     <constructor-arg value="cas" />
>     <constructor-arg ref="hazelcast" />
> </bean>
> 
> <bean id="my.StorageService.idpSession"
>       class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
>     <constructor-arg value="session" />
>     <constructor-arg ref="hazelcast" />
> </bean>
> 
> 
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Paul B. Henson
> Sent: Tuesday, September 6, 2016 10:07 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: cas protocol behind an F5
> 
> On Tue, Sep 06, 2016 at 07:57:27PM +0000, Niva Agmon wrote:
> 
> > It looks like the nodes do connect, but I can only see the ticket on 
> > one of the nodes (number 2), even though they are both configured the
> > same:
> 
> Have you looked at Unicon's hazelcast storage backend? We've been using that since June and found it very reliable for clustering. It's currently an extra add-on but I think Scott is looking at possibly including it in the next release.
> 
> --
> Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/ Operating Systems and Network Analyst  |  henson at cpp.edu California State Polytechnic University  |  Pomona CA 91768
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768