Shibboleth SP3, TCPListener's clientAddress & Kubernetes

[Robert Bradley]

On 28/01/2021 12:56, Sandro Mathys wrote:
> Hi all,
> 
> I'm working on putting a website "secured" with Shibboleth SP3 on 
> Kubernetes, with apache/mod_shibd and shibd running in separate 
> containers and actually separate pods.
> 
> For those not familiar with Kubernetes, this is similar to putting 
> apache/mod_shibd on one server and shibd on another server in the same 
> local network.
> 
> However, at the time that I'm writing the shibboleth2.xml, I can't be 
> sure about shibd's IP address. What I can rely on however is it's DNS 
> address – that's the Kubernetes way (well, that or using APIs).
> 
> But unfortunately, the TCPListener only accepts an "IP address in 
> decimal dotted notation" for the clientAddress, see [1].

I don't know nearly enough about Kubernetes, unfortunately, but is there 
any reason why you couldn't run one shibd container per pod and then use 
shared Unix sockets within each pod?  You'd then have to set up the SP3 
clustering config to distribute the sealer keys to each pod, but it 
might solve the issue more simply.

If you need to do IdP discovery in your service provider, you could run 
a single container to fetch a full aggregate for discovery service JSON 
purposes (and also generate sealer keys) and then use MDQ on the service 
pod instances.

-- 
Dr Robert Bradley
Identity and Access Management Team, IT Services, University of Oxford

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20210201/af199b20/attachment.sig>