Load Balancing Shibboleth

[Cantor, Scott]

> With shibboleth IdP v3, and the session cookies, we found that
> stickiness was much less important.

It hasn't really changed in that regard.

> Rolling restarts of our IdP cluster
> nodes are undetectable, as long as the load balancer drops new
> connections to the node about 30 seconds before the IdP service is
> turned off.

Anybody on the login page that submits their credentials and ends up on the other node is going to see an error. We use grace of maybe 3-5 minutes, depending on time of day, but at scale, anything less will be very noticeable to some.

-- Scott