<div dir="ltr">Just a complete shot in the dark, but what if you set each node to use an HTTP KeepAlive with a long timeout? The idea being getting the browser to maintain an open connection to the node while the user is entering their credentials. Submission of the form would then (hopefully) happen over the existing connection back to the same node & thus allow everything to succeed.<div>
<br></div><div>Dave</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Jan 21, 2014 at 3:21 PM, Wessel, Keith <span dir="ltr"><<a href="mailto:kwessel@illinois.edu" target="_blank">kwessel@illinois.edu</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">All,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I’m trying to find a way for our IDP nodes to remain sticky for a user throughout the login process in a GSLB environment where client stickiness isn’t an option. The GSLB talks to DNS servers, not clients, and we don’t want our entire
campus DNS resolver to be sticky to a single IDP node if we can help it.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">We deployed Paul’s excellent database-backed storage service but had to back out the change. As I understand it, the login process has to stick to a single IDP node when using this solution and, sure enough, we saw problems when a user’s
browser started on one IDP node then went to the other, either while getting to the login page or when the login page was submitted. Since the session wasn’t yet known to the other IDP node, the login couldn’t be completed.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Can anyone make any suggestions of how we might, once a user hits node 1 or node 2, keep them going back to that node until they’re logged in and returning to the SP? I see no easy way to, say, put an absolute URL in place of /idp for all
of the relative URLs presented by the IDP.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">If we can’t accomplish this, we’re planning to still use the database-backed storage service combined with active-passive from our GSLB. But we really do like being able to balance traffic between the two sites when they’re both available.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
<p class="MsoNormal">Keith<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br>David Langenberg<div>Identity & Access Management</div>
<div>The University of Chicago</div>
</div>