Overloaded shibd questions

[Nate Klingenstein]

> Unless you're dealing with, maybe, passive rules, that's not possible, the requests just don't go further if the session lookup fails, and they'd bounce back to the IdP (that would be a loop, perhaps).

I believe we are dealing with passive rules.

> I didn't think even a passive rule would pass along no attributes, but it's not implausible there might be such a code path since that approach implies it's ok not to have a session.

That was my thinking.

> Well, it's a hack, but it works. It's certainly more practical than a database for clustering. But you can't expect to constantly switch nodes and not see it kill performance to some extent. The SP cannot run without stickiness, period.

I haven't confirmed, but I'm certain there is brief stickiness to the application servers for the initial login before transitioning into the application-specific session.  Things are fine once the application session has been created.