[IdP 3] Clustering and Backchannel

[Cantor, Scott]

On 4/7/17, 9:57 AM, "users on behalf of Peter Schober" <users-bounces at shibboleth.net on behalf of peter.schober at univie.ac.at> wrote:

> So configuring the loadbalancer to pass through traffic to the
> backchannel port unmolestet should do, and keep interop with older SAML SPs?

Generally, although that's not always possible with some load balancers (not that it's physically a problem, it's just not how the organization might be using it or be prepared to configure it).

The "best" advice going forward is to urge people to run current SPs, start putting the SOAP traffic on 443, and hopefully move things over to signed messages, but the older SPs won't sign unless they're told to, regardless of the port.

SWITCH / Halm asked me to facilitate this kind of thing a long time ago and unfrortunately it just didn't really get done until I had time with the IdP to think about how we could handle the transition, and by then the back-channel just became less an issue, for SAML at least.

-- Scott