<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">
<div><br>
</div>
<div>We are at the point where we are seriously looking at IdP clustering as a way to provide higher reliability and availability.</div>
<div><br>
</div>
<div>Our current configuration has our IdP service is behind an F5 load balancer. We currently have two servers, but run them in a warm-standby configuration, where at any given point one server handles all traffic. The other is configured identically, but
is not running Apache/Tomcat normally, and is only started if we need to fail over for some reason. I could automate the failover, but that still means that all current sessions are invalidated. Also, we must continue to support back-channel attribute queries,
so session state must be shared between our IdPs. We are using the username/password LoginHandler, authenticating via JAAS to Kerberos.</div>
<div><br>
</div>
<div>So, I'm looking at the options. </div>
<div><br>
</div>
<div>First, there is Terracotta. Having experimented with this in the past, this seems to be a fairly complicated solution, with very fragile dependencies on the specific versions of Teracotta. I had this running briefly, but rolled it back because of instability
(sessions were not always being shared, and attribute queries would fail because of it). </div>
<div><br>
</div>
<div>Second there is Manual Haim's <span class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 13px; line-height: 17px; ">Memcached StorageService, which may be able to be used with repcached to provide
shared state. Is anyone using this in production, either with or without repcached?</span></div>
<div><span class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 13px; line-height: 17px; "><br>
</span></div>
<div><span class="Apple-style-span" style="color: rgb(51, 51, 51); font-family: Helvetica, Arial, sans-serif; font-size: 13px; line-height: 17px; ">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; line-height: normal; font-size: medium; ">
Second, there is the IdPStatelessClustering page in the wiki. This appears to be able to be made to do what I need it to, with the caveat of needing a custom LoginHandler using DataSealer to provide SSO, and the CryptoTransientPrincipalConnector to provide
back channel attribute queries. Is anyone using this in production? Is there a sample of how to use DataSealer with UsernamePassword in this way?</div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; line-height: normal; font-size: medium; ">
<br>
</div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; line-height: normal; font-size: medium; ">
-jeaton</div>
<div><br>
</div>
</span></div>
</body>
</html>