<div>Thanks for the response. I will need to check out the load balancer in more detail. </div>
<div></div>
<div>Should I see something in the idp-process.log though since it did make it through the load balancer to the idp error page. I'm not seeing anything in the idp-process.log when this occurs. I was hoping to see something there that might shed some light on why it thinks it is an invalid URL.</div>
<div></div>
<div>Thanks,</div>
<div></div>
<div>Gene</div>
<div></div>
<div></div>
<div></div>
<div>----- Original Message -----<br />From: Nate Klingenstein <ndk@internet2.edu><br />To: Shib Users <users@shibboleth.net><br />Sent: Wed, 11 Dec 2013 19:04:55 -0500 (EST)<br />Subject: Re: shibboleth-idp behind a load balancer?</div>
<div></div>
<div><br />There could be something in the dialect of load balancing being used here that needs to be understood, such as 8443 -> 443(more likely to cause problems) or 443 -> 443(less likely to cause problems). Without knowing the precise details of how each portion<br /> of the setup is intended to run, it's hard to describe exactly how to string them together.</div>
<div><br />
<div>
<div>On Dec 12, 2013, at 8:59 AM, Jesse Santana <<a href="mailto:Jesse.Santana@csulb.edu" target="_blank">Jesse.Santana@csulb.edu</a>></div>
<div> wrote:</div>
<br class="Apple-interchange-newline" />
<blockquote>
<div lang="EN-US" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
<div class="WordSection1" style="page: WordSection1;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">Gene,</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">We have exactly this configuration here at CSULB. Our load balancer is configured to respond to<span class="Apple-converted-space"> </span><a href="http://idp.csulb.edu" style="color: purple; text-decoration: underline;" target="_blank">idp.csulb.edu</a><span class="Apple-converted-space"> </span>and<br /> has IP sticky session enabled so that all requests from a specific IP address are always sent to the same back end Shibboleth IdP. This works just fine and I have informed my user community that, should the IdP they are connected to fail, they will need to<br /> re-authenticate. I’m looking into memcached now to see if this can be addressed as well.</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">When I installed the first IdP, I define the FQN as<span class="Apple-converted-space"> </span><a href="http://idp.csulb.edu" style="color: purple; text-decoration: underline;" target="_blank">idp.csulb.edu</a>. <br /> Once it was up and running, I setup the second IdP with the same FQN but then copied the idp-metadata.xml from the first IdP to make sure they were both the same.</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">I hope this helps and if I am doing something wrong, please someone feel free to say so.</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">Jesse</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">Jesse Santana</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">Assistant Director - Enterprise Systems and Servers</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">CSU Long Beach – Network Services</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">1250 Bellflower Blvd.</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">Long Beach, CA 90840</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;">(562)985-8511</span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: #1f497d;"> </span></div>
<div>
<div style="border-style: solid none none; border-top-width: 1pt; border-top-color: #b5c4df; padding: 3pt 0in 0in;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"><span class="Apple-converted-space"> </span><a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a><br /> [mailto:users-<a href="mailto:bounces@shibboleth.net" target="_blank">bounces@shibboleth.net</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Gene Matthews<br /><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, December 11, 2013 2:51 PM<br /><b>To:</b><span class="Apple-converted-space"> </span>Shib Users<br /><b>Subject:</b><span class="Apple-converted-space"> </span>shibboleth-idp behind a load balancer?</span></div>
</div>
</div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><br /> </div>
<div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>Hi,</span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span> </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>I'm managing a shibboleth-idp that we have had in test and are now ready to move into production. The production environment has two shibboleth-idp servers behind it. They use LDAP as their back-end with LDAP replicating updates back and forth. <br /> I believe I have the ldap replication working ok and from within the environment I can get the status page ('ok' from<a href="https://myidpserver:8443/idp/profile/Status" style="color: purple; text-decoration: underline;" target="_blank">https://myidpserver:8443/idp/profile/Status</a>)<br /> to return 'ok'. </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span> </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>When I go to the<span class="Apple-converted-space"> </span><a href="https://loadbalancer-for-idp:8443/idp/profile/Status" style="color: purple; text-decoration: underline;" target="_blank">https://loadbalancer-for-idp:8443/idp/profile/Status</a>I land on the<br /> error-404.jsp page (invalid URL). I don't control the load balancer and am working to see if there is any logging going on there. I don't see anything in the idp-process.log when I do this. Should I see something in the idp-process.log? The http request<br /> is obviously getting through the load balancer or I would get the error-404.jsp page displayed. I've edited the jsp page to have the hostname displayed so I know which of the two idp servers is ending up with the request (always idp1 so far).</span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span> </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>Has anyone done anything like this? Any reason shibboleth-idp couldn't operate in an environment like this? Should I see something in the log?</span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span> </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>Thanks for any insight.</span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span> </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>Thanks,</span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span> </span></div>
</div>
<div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;"><span>Gene</span></div>
</div>
</div>
</div>
<br />--<br />
<div></div>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank"><br />users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
</div>
<div></div>
<div></div>