Recommended practices for Dockerizing the IdP

[Wessel, Keith]

All,

Hoping others who have already done this might have some wisdom to share.

We're in the process of moving our IdP to the cloud, specifically to an AWS Elastic Beanstalk instance. Dockerizing the IdP isn't hard and, in fact, we can leverage TIER's packaging should we choose to and if we're willing to move from jetty back to Tomcat.

Specific areas of interest are logging and data sealer credential storage.

I'm assuming, with all of the logs coming out of Tomcat/Jetty and the IdP, it's best to send the application server logs to stdout and everything else to a syslog server, but I'm curious if others have other ideas.

The data sealker creds lend themselves to externally mounted storage for consistency across restarts, but if anyone can suggest another way to handle this that's lighter weight, I'd be interested.

Of less significance is metadata: presumably, the IdP will pull down the latest federation metadata aggregate on start-up, but if for som reason that's unavailable, we'll be stuck with any metadata stored in the Docker image as a fallback. This could be stale. Any recommendations for dealing with this?

Thanks for any guidance,
Keith