SP 3 and reverseProxy

[Guillaume Rousse]

Le 28/10/2018 à 23:12, Jehan PROCACCIA a écrit :
> hello
> 
> it is not clear to me if I can use an apache reverseProxy to serve multiple web application and save the pain of deploy shibboleth SP on each of those web hosts.
> The idea beeing to install,configure and publish metadata of a single shibboleth SP only for the reverseProxy and not on the all the multiple ressources web hosts.
> 
> from https://wiki.shibboleth.net/confluence/display/SHIB2/SPReverseProxy it seems that while using a reverseProxy we still need to deploy shibboleth SP on the ressource server (web applications), so there's no deploy and configure factoring gain with the reverseproxy !?
> 
> with SP3 doc, there's no more specific reverse proxy doc, appart from :
> 
> https://wiki.shibboleth.net/confluence/display/SP3/OneOrMany
> 
> I understand that serving hundreds of web apps behind a single reverseProxy will be a spof and a bottleneck , but for a dozen of web apps is it still possible ? recommended ?
Hello.

We (GIP RENATER, the french NREN) currently have approximatively 30 
applications behind a cluster of two reverse-proxy, configured in 
active-passive setup. From our experience, having the service providers 
managed by the people in charge of running applications is a nightmare 
in term of maintenance and evolution, as they generally have different 
priorities as yours, so the decoupling is a huge gain for us. For 
instance, we managed the SP version switch on those proxies from 2.x to 
3.x in less than one month, whereas some old standalone SPs are still 
using old metadata URLs we are trying to deprecate since 2 years now...

The only adverse effect we had sofar was not performance or reliability 
(that's a cluster, we can add new nodes in just a couple of hours, or 
change the load balancing algorithm), rather the concentration of 
application-specific issues in a single point, while having to isolate 
each application from others, that makes the whole SP configuration 
quite complex. For instance, we currently have a 4-minutes starting 
metadata loading delay at startup, because of the multiple metadata sets 
required by different applications. And rather than just the pure number 
of applications to handle, I currently feel the number of specific 
configurations as an hard limit to this architecture: having 100 
applications using the same metadata, and the same sessions parameters, 
seems easier than 12 using 12 slightly different setup.

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20181029/5afc54a4/attachment.p7s>