A note about mod_shib2 and mod_http2

[Jacob Lundberg]

Hi Scott,

On Sat, 2017-08-19 at 00:25 +0000, Cantor, Scott wrote:
> That's likely a locking bug reported and patched months ago (the original reporter was kind enough to debug it and provide a fix). I don't have the issue link to hand, but it isn't released yet in any case.

This one?
https://issues.shibboleth.net/jira/si/jira.issueviews:issue-html/CPPXT-116/CPPXT-116.html

> It's nothing to do with their code

Except that, interestingly, I've never seen it trigger without h2 and as
soon as we turn h2 on it triggers quite frequently.  Perhaps the h2
workers create a second instance of something the httpd workers already
created...

> all you have to do is not modify the configuration file without a restart

Our SP takes fifteen minutes to validate config and start up.  I'd hate
to take this route.

> (or disable reloading support, though that's a bit tricky).

This we could try but I assume then we'd still have to restart for every
configuration change.  Those happen at least a few times a week.

We might consider giving HTTP/2 one last try, if we can get a patched
build of the SP installed next week.  If we do manage to test it I'll
let you know how it goes.

Thanks,
-Jacob

-- 

Jacob Lundberg
AVP, IT Architecture
503.290.0100 (voice)
503.973.5252 (fax)