<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">David,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Agreed. We have not had a failure either. I’m only now looking into this because our Shibboleth environment is becoming more mission critical and our powers
that be are requesting full redundancy wherever possible.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Jesse<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Jesse Santana<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Assistant Director - Enterprise Systems and Servers<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">CSU Long Beach – Network Services<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">1250 Bellflower Blvd.
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Long Beach, CA 90840<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">(562)985-8511<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> David Bantz [mailto:dabantz@alaska.edu]
<br>
<b>Sent:</b> Thursday, October 24, 2013 11:23 AM<br>
<b>To:</b> Jesse Santana; Shib Users<br>
<b>Subject:</b> RE: Load balancing both the SP and IdP<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div id="bloop_customfont">
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif""><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="color:#A0A0A8">On Thursday, 24 October 2013 at 10:06:02, Jesse Santana (<a href="mailto://jesse.santana@csulb.edu">jesse.santana@csulb.edu</a>) wrote:<o:p></o:p></span></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif"">Our configuration at CSU Long Beach is almost identical to the one Andrew described. The question I have for Andrew is, how do you handle session
replication? As our configuration stands today, if one of our IdP's dies, the users bound to that IdP must re-authenticate. How are you avoiding this? I am looking into memcached as a possible solution but wanted to hear your thoughts.<span class="apple-converted-space"> </span><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
<p>We have this config for our IdP as well and also operate as described to implement and test changes against the passive node from workstations with modified hosts file. For net reliability, you have to trade off the non-trivial complexity of session replication
across nodes against the modest increase in reliability gained. In our case, neither the IdP service nor the platform on which it runs have “died” in the past 4 years (though an incorrect config change once caused an interruption of a few minutes). <o:p></o:p></p>
<p>David Bantz<o:p></o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px">
<div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;font-family:"Helvetica","sans-serif""><br>
<br>
Jesse Santana<span class="apple-converted-space"> </span><br>
Assistant Director - Enterprise Systems and Servers<span class="apple-converted-space"> </span><br>
CSU Long Beach - Network Services<span class="apple-converted-space"> </span><br>
1250 Bellflower Blvd.<span class="apple-converted-space"> </span><br>
Long Beach, CA 90840<span class="apple-converted-space"> </span><br>
(562)985-8511<span class="apple-converted-space"> </span><br>
<br>
<br>
-----Original Message-----<span class="apple-converted-space"> </span><br>
From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] On Behalf Of Martin, Andrew J.<span class="apple-converted-space"> </span><br>
Sent: Thursday, October 24, 2013 10:51 AM<span class="apple-converted-space"> </span><br>
To: Shib Users<span class="apple-converted-space"> </span><br>
Subject: RE: Load balancing both the SP and IdP<span class="apple-converted-space"> </span><br>
<br>
We have a "master" virtual IP address in our F5 load balancer that hosts the pool of Shibboleth nodes. That's the actual service URL that's used everywhere. As I mentioned before, when we address Shibboleth through the "pool", only one server is considered
active and will respond at a time.<span class="apple-converted-space"> </span><br>
<br>
However, we also have our load balancer set up so that we can address nodes individually from certain administrative VLANs. This has come in handy for monitoring the IdP status of each node from something like SCOM. If I want to test against the passive node,
I'd simply use my workstations' local hosts file to repoint the shib service hostname to instead refer to the accessible IP address of the passive node, as opposed to the F5 pool (of all servers). As long as I test with the workstation with the modded 'hosts'
file, I can direct my requests to the 'passive' node while everyone else is still pointed to active.<span class="apple-converted-space"> </span><br>
<br>
There may be some scenarios where this isn't ideal, but it's worked for testing most of my integrations. Just remember to clean up your hosts file when you're done, or you may be confused why things resolve incorrectly later...<span class="apple-converted-space"> </span><br>
<br>
-----Original Message-----<span class="apple-converted-space"> </span><br>
From: <a href="mailto:users-bounces@shibboleth.net">users-bounces@shibboleth.net</a> [<a href="mailto:users-bounces@shibboleth.net">mailto:users-bounces@shibboleth.net</a>] On Behalf Of Kevin P. Foote<span class="apple-converted-space"> </span><br>
Sent: Thursday, October 24, 2013 12:06 PM<span class="apple-converted-space"> </span><br>
To: Shib Users<span class="apple-converted-space"> </span><br>
Subject: Re: Load balancing both the SP and IdP<span class="apple-converted-space"> </span><br>
<br>
<br>
On Thu, 24 Oct 2013, Tom Zeller wrote:<span class="apple-converted-space"> </span><br>
<br>
>> It also makes upgrading a snap since we can test new upgrades and configurations on the "passive" node without necessarily affecting production.<span class="apple-converted-space"> </span><br>
><span class="apple-converted-space"> </span><br>
> Just curious what criteria you use during testing to select a node. IP address ?<span class="apple-converted-space"> </span><br>
<br>
Sorry not the OP ..<span class="apple-converted-space"> </span><br>
<br>
Most ADCs or Loadbalancers allow you to select a specific node or pool of nodes depending on incoming criteria.. so yea IP of originating request is pretty simple.<span class="apple-converted-space"> </span><br>
<br>
So for me when testing / upgrading. I enable a rule that says if my workstation is accessing the IdP service go to this particular node or pool that is defined on the ADC.<span class="apple-converted-space"> </span><br>
<br>
<br>
<br>
------<span class="apple-converted-space"> </span><br>
thanks<span class="apple-converted-space"> </span><br>
kevin.foote<span class="apple-converted-space"> </span><o:p></o:p></span></p>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>