<div dir="ltr">Hi all,<div><br></div><div>I'm just getting started with a new SP installation to protect a service we believe will be very very active in short time. To keep up with the demand we expect from our users, we're load balancing our application which is IIS/SQL Server. We will have a LOT of users from a LOT of different institutions using our application. Most will use SAML/Shibb for authentication. Not only will we have a lot of users, we expect a lot of concurrent users. High-availability is a must.</div>
<div><br></div><div>Before posing my actual question I should mention that we'll be using the SP in the "bootstrap" fashion, wherein we'll be initiating an authentication request to the IdP and getting the response. From there, we'll look at the return attributes and make a decision about what permissions/roles/accessibility the user has. We'll create a session for the user in our application at which point we no longer care about the Shibboleth session. Our load balancer is round-robin and we are leaning (as my CTO says) HEAVILY away from server affinity or stickiness. </div>
<div><br></div><div>So my question for this group is: If I install the Shibb SP on each server is it true that if server[1] in my load balancer accepts a user request for protected resources and initiates an authentication request to the proper IdP, (based on the previous paragraph) can server[2] handle the POST coming from the IdP (if so chosen by the load balancer) so I can log in my user as described? Again, I won't need the Shibboleth session (that I'm aware of). If that turns out to not be true, what might you recommend.</div>
<div><br></div><div>Thanks,</div><div><br></div><div>-Jim</div></div>