Shibboleth IdP HA

[Peter Schober]

* El Manaa Amine via users <users at shibboleth.net> [2023-08-17 17:11]:
> Do you see any potential issues with this architecture? Do you have
> other recommendations for a highly available IdP setup? Am I missing
> something?

The IDP has been specifically architected to support such
operationally trivial "shared nothing" clustering, which is no small
feat, IMO. So no, nothing else should be needed.

Of course any configured data sources (LDAP, RDBMS, web services,
etc.) utilised by the IDP should also be highly available then.
  But even some failure scenarios can be handled more resiliently with
careful IDP configuration, e.g. by making certain attribute
definitions (that depend on non-HA data sources) depending on the
SP/RP being accessed. Or by adding appropriate failover data
connectors.

-peter