A short study about Shibboleth performances.

[Cantor, Scott]

On 8/28/19, 12:20 PM, "users on behalf of Dan McLaughlin" <users-bounces at shibboleth.net on behalf of dmclaughlin at tech-consortium.com> wrote:

> After finding this email thread I decided to try setting
> maintainReverseIndex="false" and ever since the SP hasn't crashed
> once, where before it was crashing at least 3-4 times in the morning
> and after lunch time.

That's probably memory exhaustion, particularly if the NameIDs aren't short. That's a lot of extra data getting carried around. It could also be as simple as stack exhaustion under load if it were a preforked Apache, but that probably wouldn't get any better so I doubt that’s it.

If you don't support logout, then I certainly wouldn't leave the setting on just out of common sense. There isn't any way to support SAML logout properly without it.

But ultimately, that's NAT. I don't think most SPs "in the wild" really have much choice about address binding.

-- Scott