Load Balancing Shibboleth

[Allan West]

With shibboleth IdP v3, and the session cookies, we found that
stickiness was much less important. Rolling restarts of our IdP cluster
nodes are undetectable, as long as the load balancer drops new
connections to the node about 30 seconds before the IdP service is
turned off.
Allan West

On 2017/11/27 1:11 PM, Craig Pluchinsky wrote:
> When I clustered our IDP nodes it was pretty simple.  Installed the
> IDP on one node, got it up and running, then copied the IDP_HOME to
> the other node.
>
> If you use the cookie storage you don't have to worry about a database
> since session data is stored at the client.  Key here is to keep the
> sealer key the same on each nodes.  I had a cron job that rolled the
> key every week and scp'd it to the other node.
>
> Final key is to make sure you have some sort of session stickiness to
> keep the clients going to the same node as where they initially started.
>
>
> -------------------------------
> Craig Pluchinsky
> IT Services
> Indiana University of Pennsylvania
> 724-357-3327
>
>
> On Mon, 27 Nov 2017, Jason Rotunno wrote:
>
>> Hi All,
>>
>> We're currently running a single Shib 3.3.x IdP instance but we're
>> planning on setting up a second instance and load balancing them for
>> high availability.
>>
>> For the most part, I assume they should be setup identically -- same
>> hostname, entityID, Metadata, signing cert, etc. Aside from
>> different IPs, the only other difference between them that I'm aware
>> of is that the same DataSealer key should be used on both hosts; in
>> other words, they shouldn't both be running a cron job to rotate the
>> keys.
>>
>> Is there anything else that should be unique to each host?
>>
>> I've been reading some documentation on setting up an HA environment
>> and I realize that there are other factors that need to be
>> considered; for example, potentially making storage entities
>> persistent (e.g. storing their values in a database). But at this point,
>> I'm just looking at the 'base' IdP setup.
>>
>> Thanks,
>> Jason
>>
>>
>> -- 
>>
>> Jason Rotunno
>> System & Security Administrator
>> Swarthmore College
>> 500 College Ave
>> Swarthmore, PA 19081
>> 610.328.8505
>>
>> Think BEFORE You Click!! Emails from Swarthmore College ITS won't be
>> in your
>> Quarantine or Spam folder. We won't threaten you either! If you
>> receive any phishing emails, please forward them to
>> phishing at swarthmore.edu.
>>
>> [icon-envelope-tick-round-orange-animated-no-repeat-v1.gif]
>> Virus-free. www.avast.com
>>
>>