cas protocol behind an F5
Niva Agmon
nagmon at temple.edu
Wed Sep 14 12:24:17 EDT 2016
Thanks a lot, really appreciate it, Paul.
I updated our config based on your example with used heap percentage and that seemed to do the trick (was still getting the exception after changing the default hazelcast.max.no.heartbeat.seconds to 300).
Niva
-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Paul B. Henson
Sent: Monday, September 12, 2016 9:09 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: cas protocol behind an F5
On Mon, Sep 12, 2016 at 08:17:05PM +0000, Niva Agmon wrote:
> Still seeing the exception errors when recycling the IDP.
I don't recall ever seeing those errors. Here's the config I'm using, the main differences seem to be that I have port auto increment disabled and I'm using the default hazelcast.max.no.heartbeat.seconds of 300. 5 is a bit tight, I know that's the default in the config in the example, but you might try increasing that a bit and seeing if maybe that's causing an issue? Depending on how long your container is taking to shut down could be a node is getting kicked out before it can gracefully exit.
<hz:hazelcast id="hazelcast">
<hz:config>
<hz:properties>
<hz:property name="hazelcast.logging.type">slf4j</hz:property>
</hz:properties>
<hz:network port="5701" port-auto-increment="false">
<hz:join>
<hz:multicast enabled="false"/>
<hz:tcp-ip enabled="true">
<hz:members>__IDP_NODE1__, __IDP_NODE2__, __IDP_NODE3__</hz:members>
</hz:tcp-ip>
</hz:join>
<hz:reuse-address>true</hz:reuse-address>
</hz:network>
<hz:map name="sso_session"
max-size-policy="USED_HEAP_PERCENTAGE"
max-size="50"
eviction-policy="LRU"
eviction-percentage="5"/>
<hz:map name="replay_cache"
backup-count="0"
max-size-policy="USED_HEAP_PERCENTAGE"
max-size="5"
eviction-policy="LRU"
eviction-percentage="5"/>
<hz:map name="cas_tickets"
read-backup-data="true"
max-size-policy="USED_HEAP_PERCENTAGE"
max-size="10"
eviction-policy="LRU"
eviction-percentage="5"/>
</hz:config>
</hz:hazelcast>
<bean id="edu.cpp.ssoHazelcastStorageService"
class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
<constructor-arg name="mapName" value="sso_session" />
<constructor-arg name="hazelcastInstance" ref="hazelcast" />
</bean>
<bean id="edu.cpp.replayHazelcastStorageService"
class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
<constructor-arg name="mapName" value="replay_cache" />
<constructor-arg name="hazelcastInstance" ref="hazelcast" />
</bean>
<bean id="edu.cpp.casHazelcastStorageService"
class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
<constructor-arg name="mapName" value="cas_tickets" />
<constructor-arg name="hazelcastInstance" ref="hazelcast" />
</bean>
> This is our Hazelcast configuration:
>
> <!-- Hazelcast storage configuration --> <bean id="hazelcast" class="com.hazelcast.core.Hazelcast" factory-method="newHazelcastInstance">
> <constructor-arg name="config">
> <bean class="com.hazelcast.config.Config">
> <property name="properties">
> <util:properties>
> <prop key="hazelcast.logging.type">slf4j</prop>
> <prop key="hazelcast.max.no.heartbeat.seconds">5</prop>
> </util:properties>
> </property>
> <property name="networkConfig">
> <bean class="com.hazelcast.config.NetworkConfig">
> <property name="port" value="5701"/>
> <property name="portAutoIncrement" value="true"/>
> <property name="join" ref="tcpIpHazelcastJoinConfig"/>
> </bean>
> </property>
> </bean>
> </constructor-arg>
> </bean>
>
> <bean id="tcpIpHazelcastJoinConfig" class="com.hazelcast.config.JoinConfig">
> <property name="multicastConfig">
> <bean class="com.hazelcast.config.MulticastConfig">
> <property name="enabled" value="false"/>
> </bean>
> </property>
> <property name="tcpIpConfig">
> <bean class="com.hazelcast.config.TcpIpConfig">
> <property name="enabled" value="true"/>
> <property name="members" value="%{hz.cluster.members:--shib_node1----,---shib_node2---}"/>
> </bean>
> </property>
> </bean>
>
> <bean id="my.HazelcastStorageService"
> class="net.unicon.iam.shibboleth.storage.HazelcastMapBackedStorageService">
> <constructor-arg name="hazelcastInstance" ref="hazelcast" />
> </bean>
>
> <bean id="my.StorageService.cas"
> class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
> <constructor-arg value="cas" />
> <constructor-arg ref="hazelcast" /> </bean>
>
> <bean id="my.StorageService.idpSession"
> class="net.unicon.iam.shibboleth.storage.SingleHazelcastMapBackedStorageService">
> <constructor-arg value="session" />
> <constructor-arg ref="hazelcast" /> </bean>
>
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Paul B.
> Henson
> Sent: Tuesday, September 6, 2016 10:07 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: cas protocol behind an F5
>
> On Tue, Sep 06, 2016 at 07:57:27PM +0000, Niva Agmon wrote:
>
> > It looks like the nodes do connect, but I can only see the ticket on
> > one of the nodes (number 2), even though they are both configured
> > the
> > same:
>
> Have you looked at Unicon's hazelcast storage backend? We've been using that since June and found it very reliable for clustering. It's currently an extra add-on but I think Scott is looking at possibly including it in the next release.
>
> --
> Paul B. Henson | (909) 979-6361 | http://www.cpp.edu/~henson/
> Operating Systems and Network Analyst | henson at cpp.edu California
> State Polytechnic University | Pomona CA 91768
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
--
Paul B. Henson | (909) 979-6361 | http://www.cpp.edu/~henson/ Operating Systems and Network Analyst | henson at cpp.edu California State Polytechnic University | Pomona CA 91768
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list