SP State and Clustering

[Bill Moseley]

Hello,

I'm pretty new to Shibboleth and have a very basic question.

I have read NativeSPClustering
<https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPClustering> as
well as posts in this list's archives and other posts online about
clustering.  What I have read so far implies that state is saved on the SP,
so that when the user returns from authenticating at the IdP they *must
return to the same* SP.

BTW -- Returning to the same SP is not important for our web application as
the application does not share sessions with the SP.  (The SP "resource"
makes an API call to the application which returns a user-specific redirect
URL to the web app that is passed back to the browser.)

Just to be clear, is there state stored on the SP even if we use
relayState="cookie"?


I'm asking because it takes quite a bit of time to restart shibd (about 8
minutes) and during this time the SP is unavailable.  Our load balancer is
currently configured for sticky sessions (by IP) for the SP cluster.  So,
if one of the SPs in the cluster is taken down then any in-flight
authentications would fail.


I understand there are methods to share SP state in a cluster (e.g.
memcached), but then we are back to a single point of failure. The
cluster's purpose is for High Availability, not for load.

Thanks,
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170314/2260ef4f/attachment.html>