NativeSPClustering- shared shibd

[Peter Schober]

* Vedran Bartonicek <vbartoni at gmail.com> [2016-09-15 06:58]:
> I think that shibd would not be a SPOF  since two nodes running shibd would
> be in active - passive configuration.
> From user's point of view failover is seamless (as much as I tested it).
> That said, I am not that experienced in Shib world, so any feedback on SP
> HA is greatly appreciated.

I don't understand what that means. Either you share one shibd process
between several nodes (getting shared state, but also an SPOF) or you
don't (not getting shared state and each node manages its own sessions
with a local shibd).
Or are you talking about two layers of clustering here, e.g. 2 nodes
sharing a shibd making up one logical system , and another 2 nodes
sharing (another) shibd process, and combining those 4 nodes into one
system via some method?

> But after above discussion, I think I will drop this architecture with
> shared shibd, and instead have SP in single node, and configure it in
> active-passive mode.
> What worries me is SSL termination (done at SP machine), as a possible
> bottleneck if there is a lot of traffic for the Tomcat cluster behind SP.
> But maybe I should start a new thread with SP HA title or something like
> that.

We know exactly nothing about your deployment, the protected resource
(and how it manages its session) or your requirements. We also don't
know why you want to cluster the shib session (the docs mention that
this should rarely be necessary). At this point speculation about TLS
overhead is not only off-topic here, it's also premature to be
concerned about that now. (After all the Shib SP itself may beome a
much bigger issue under such loads.)

And you can always offload TLS processing from the machine, that does
not involve Shibboleth in any way, and does not touch on anything
discussed here so far.
-peter