SP 3 and reverseProxy

[Jehan PROCACCIA]

On 29/10/2018 10:15, Guillaume Rousse wrote:
> Hello.
>
> We (GIP RENATER, the french NREN) currently have approximatively 30 applications behind a cluster of two reverse-proxy, configured in active-passive setup. From our experience, having the service providers managed by the people in charge of running applications is a nightmare in term of maintenance and evolution, as they generally have different priorities as yours, so the decoupling is a huge gain for us. For instance, we managed the SP version switch on those proxies from 2.x to 3.x in less than one month, whereas some old standalone SPs are still using old metadata URLs we are trying to deprecate since 2 years now...

you talk about "reverse-proxy", as Peter and Scott responded to me, in order not to confuse my objectives (factorizing SP deployement to a single proxy) , your architecture should be called "forward proxy" , do you agree ?   

> The only adverse effect we had sofar was not performance or reliability (that's a cluster, we can add new nodes in just a couple of hours, or change the load balancing algorithm), rather the concentration of application-specific issues in a single point, while having to isolate each application from others, that makes the whole SP configuration quite complex. For instance, we currently have a 4-minutes starting metadata loading delay at startup, because of the multiple metadata sets required by different applications. And rather than just the pure number of applications to handle, I currently feel the number of specific configurations as an hard limit to this architecture: having 100 applications using the same metadata, and the same sessions parameters, seems easier than 12 using 12 slightly different setup.

that seems to fulfill my objectives, but I am still confuse when you talk about "multiple metadata sets required by different applications" 
on your central Proxy SP deployement, do you have to specify overrides for each application and hence have to publish metadatas for each of them ? 
did you wrote a doc/cookbook on this architecture ? I guess that's the one: https://services.renater.fr/federation/docs/fiches/reverseproxy (it does link to whiki shib 1.x SPForwardProxy ) 
I hope it still works with recent versions (apache 2.4, SP 3) 

thanks .