<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Tahoma",sans-serif;
color:#1F497D;
font-weight:normal;
font-style:normal;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-GB" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Not an F5, but we’re currently going through a migration to Azure, and started off with an Azure load balancer in front of our two IdP
v3 servers. There were errors due to the whole logon session not being performed on one server (traffic being shared). We’ve now changed the load balancer to a traffic manager so that there’s effectively one live and one “hot standby” server, which seems to
be working better. (This arrangement should also ensure that back channel traffic goes to the same server, though this is not yet tested). I think you could achieve something similar with your F5.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Hope this helps.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US">Richard<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Tahoma",sans-serif;color:#1F497D;mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Niva Agmon<br>
<b>Sent:</b> 02 September 2016 01:52<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> cas protocol behind an F5<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">Our CAS protocol users started getting errors and failing since we put our two idp nodes behind an F5 load balancer. Our setup is: two v3.2.1 idp nodes behind an F5 load balancer, using memcached
for session & cas storage. <br>
<br>
Does anyone have a similar setup that is working for them with CAS protocol and memcached behind an F5?<br>
<br>
This is from the Cas Client server:<br>
[Fri Aug 26 12:01:45.310071 2016] [:debug] [pid 63216] mod_auth_cas.c(1442): [client 155.247.87.98:52582] MOD_AUTH_CAS: response = <?xml version="1.0" encoding="UTF-8"?>\n<SOAP-ENV:Envelope xmlns:SOAP-ENV="<a href="http://schemas.xmlsoap.org/soap/envelope/">http://schemas.xmlsoap.org/soap/envelope/</a>"><SOAP-ENV:Body><saml1p:Response
IssueInstant="2016-08-26T16:01:45.263Z" MajorVersion="1" MinorVersion="1" ResponseID="ST-1472227304672-dq7cqqPmq8RYKYavChqbAiysK" xmlns:saml1p="urn:oasis:names:tc:SAML:1.0:protocol"><saml1p:Status><saml1p:StatusCode Value="INVALID_TICKET" xmlns="<a href="http://www.ja-sig.org/products/cas/">http://www.ja-sig.org/products/cas/</a>"/><saml1p:StatusMessage>E_TICKET_EXPIRED</saml1p:StatusMessage></saml1p:Status></saml1p:Response></SOAP-ENV:Body></SOAP-ENV:Envelope>,
referer: <a href="https://xxxx.temple.edu/..../">https://xxxx.temple.edu/..../</a><br>
<br>
Any tips, ideas, suggestions will be highly appreciated!<br>
<br>
Thanks,<br>
Niva<o:p></o:p></span></p>
<p><span style="font-family:"Calibri",sans-serif;color:black">Temple University<o:p></o:p></span></p>
</div>
</body>
</html>