Load Balancing Shibboleth

[Craig Pluchinsky]

When I clustered our IDP nodes it was pretty simple.  Installed the IDP on 
one node, got it up and running, then copied the IDP_HOME to the other 
node.

If you use the cookie storage you don't have to worry about a database 
since session data is stored at the client.  Key here is to keep the 
sealer key the same on each nodes.  I had a cron job that rolled the key 
every week and scp'd it to the other node.

Final key is to make sure you have some sort of session stickiness to keep 
the clients going to the same node as where they initially started.


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Mon, 27 Nov 2017, Jason Rotunno wrote:

> Hi All,
> 
> We're currently running a single Shib 3.3.x IdP instance but we're planning on setting up a second instance and load balancing them for
> high availability.
> 
> For the most part, I assume they should be setup identically -- same hostname, entityID, Metadata, signing cert, etc. Aside from
> different IPs, the only other difference between them that I'm aware of is that the same DataSealer key should be used on both hosts; in
> other words, they shouldn't both be running a cron job to rotate the keys.
> 
> Is there anything else that should be unique to each host?
> 
> I've been reading some documentation on setting up an HA environment and I realize that there are other factors that need to be
> considered; for example, potentially making storage entities persistent (e.g. storing their values in a database). But at this point,
> I'm just looking at the 'base' IdP setup.
> 
> Thanks,
> Jason
> 
> 
> --
> 
> Jason Rotunno
> System & Security Administrator
> Swarthmore College
> 500 College Ave
> Swarthmore, PA 19081
> 610.328.8505
> 
> Think BEFORE You Click!! Emails from Swarthmore College ITS won't be in your
> Quarantine or Spam folder. We won't threaten you either! If you
> receive any phishing emails, please forward them to phishing at swarthmore.edu.
> 
> [icon-envelope-tick-round-orange-animated-no-repeat-v1.gif]
> Virus-free. www.avast.com
> 
>