SP under IIS with TCP connection to shibd socket errors

[Cantor, Scott]

On 7/8/22, 6:54 PM, "users on behalf of Paul Henson" <users-bounces at shibboleth.net on behalf of henson at signet.id> wrote:

>    I see the timeline for a possible release of SP v4 is 2024-2025, so I 
>    think it very unlikely that no security or packaging issue will pop up 
>    between now and then requiring a minor update release 8-/.

There's a non-zero chance the only thing that's going to happen is a Windows update to bump OpenSSL or curl, plus probably packages for Red Hat 9 and Amazon Linux 3. It would take a serious bug for me to consider another release. I don't think even a DoS would do it at this point unless it were really egregious.

> But I suppose  that an emergency release like that is not a planned release. But still 
> an opportunity for minor changes like this to be let out into the wild ;).

It really depends what it looks like, but it's a possibility. I'm very conservative adding code to patch releases. Just adding debugging logs, maybe, but these areas of the code may not be so simple to instrument, or it probably would have been already.

>    Hmm, I know that such a configuration is not very common and not 
>    recommended, but I don't recall having ever heard it wasn't supported? 

I've said it many times, but nobody cared, so the wiki reflects the problems with doing it instead of just saying something nobody will listen to.

It's probably fair to say it's partially supported (for members). But if the issue is "it's not performing" that's not going to get fixed. It doesn't scale, and it takes almost no load to reach that point. So you have to have a site that you know will never get any load, ever, or this is just a disaster waiting to happen.

>    I wasn't involved in the initial design/architecture of this particular 
>    deployment, I'm just looking into the sporadic failures. My gut feeling 
>    is that it is some Windows idiosyncrasy that is making it think it 
>    failed when actually it didn't and it should have tried again, but until 
>    I get some more detailed logging in place I can't say for sure.

Use the cookie feature and you get rid of the problem in minutes, that's just generally a much simpler way to go than debugging networking problems.

-- Scott