OIDC clustering

[Scott Cantor]

> On Jul 20, 2026, at 12:48 PM, Matt Brennan via users <users at shibboleth.net> wrote:
> 
> I can't speak to the official recommended way to do this, but I am running a local instance of MariaDB with Galera on each node as my StorageService. Galera syncs the tables across all of the nodes so they all have the session information regardless of which node in the cluster is hit by the request. This doesn't help if a node fails during authentication (i.e. between the password and MFA steps), but once the session is established the user (or the RP) can hit any node in the cluster and that node can validate the token / cookie / etc. 

You certainly can do that, but outside of revocation there is generally no particularly great reason to do any of that work.

If I *did* do it, I'd agree that some of approach that replicates the data across a bunch of databases running locally on each node is probably the best way to do it.

It's just important that people understand it's usually quite optional to go that far. We are rightly proud of the stateless philosophy we follow as it dramatically simplifies everything.

-- Scott