OIDC clustering

[B]

On Monday, July 20th, 2026 at 2:25 PM, Scott Cantor via users <users at shibboleth.net> wrote:

> On Jul 20, 2026, at 12:01 PM, B via users <users at shibboleth.net> wrote:
> >
> > So going back to your first reply, and keeping in mind the testing problem, by default does the code returned to the browser by /idp/profile/oidc/authorize on node A contain enough information for node B to run the resolver, so it can respond to a token or userinfo request?
> 
> Yes, on top of which as I said you can literally relay claims from node A to node B inside the tokens so they don't have to be re-acquired (or if they can't be), at the cost of making the tokens bigger. Otherwise it simply runs the resolver as normal, and the user identity is always there because it's part of the tokens, obviously.

Thanks Scott.


On Monday, July 20th, 2026 at 2:31 PM, Scott Cantor via users <users at shibboleth.net> wrote:

> > On Jul 20, 2026, at 12:48 PM, Matt Brennan via users <users at shibboleth.net> wrote:
> >
> > I can't speak to the official recommended way to do this, but I am running a local instance of MariaDB with Galera on each node as my StorageService. Galera syncs the tables across all of the nodes so they all have the session information regardless of which node in the cluster is hit by the request. This doesn't help if a node fails during authentication (i.e. between the password and MFA steps), but once the session is established the user (or the RP) can hit any node in the cluster and that node can validate the token / cookie / etc.
> 
> You certainly can do that, but outside of revocation there is generally no particularly great reason to do any of that work.
> 
> If I *did* do it, I'd agree that some of approach that replicates the data across a bunch of databases running locally on each node is probably the best way to do it.
> 
> It's just important that people understand it's usually quite optional to go that far. We are rightly proud of the stateless philosophy we follow as it dramatically simplifies everything.

Thanks Matt and Scott.


Lotic