<div dir="ltr">Thanks Nate<div><br></div><div>I will follow your recommendation<br></div><div><br></div><div><br></div><div><br></div><div>BR</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">Le mar. 1 juin 2021 à 15:24, Nate Klingenstein <<a href="mailto:ndk@signet.id">ndk@signet.id</a>> a écrit :<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Mohammed,<br>
<br>
You probably just need to implement session replication between the two shibd instances, and you may want to make use of the SessionCache for good measure.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/SP3/Clustering" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SP3/Clustering</a><br>
<a href="https://wiki.shibboleth.net/confluence/display/SP3/SessionCache" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/SP3/SessionCache</a><br>
<br>
There is nothing apparently wrong with your network or web server configuration and the failure behavior you describe would be perfectly explained by active protection of content by Shibboleth and no clustering in place.<br>
<br>
Take care,<br>
Nate.<br>
<br>
--------<br>
Signet, Inc.<br>
The Art of Access ®<br>
<br>
<a href="https://www.signet.id" rel="noreferrer" target="_blank">https://www.signet.id</a><br>
<br>
-----Original message-----<br>
From: Mohammed Maatit<br>
Sent: Tuesday, June 1 2021, 7:03 am<br>
To: <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a><br>
Subject: Help : Shibboleth SP for apache/jboss clustering environnent<br>
<br>
thank you in advance for your help<br>
<br>
I installed two nodes with an apache 2.4 (with shibd 3.1.0)/jboss eap7 on RHEL environment. <br>
In front of them I have a F5 BIG IP device which redirects https requests to the 2 nodes (sticky session activated)<br>
when SSO is disabled in my application, shibd service stopped and apache24.conf commented in httpd.conf (#Include /etc/shibboleth/apache24.config)), failover works fine.<br>
When I enable SSO, the authenfication process (sp/IDP) works fine and I am connected to the first node,so perfect. <br>
but when I stop the JBoss server that I am connected to, I do not switch to the second node and I have the 503 error. <br>
I do not see where the bad configuration is located.<br>
if I stop apache and jboss on node1, F5 redirects users to node 2 and also SSO works fine. and the reverse works well too (apache2 and jbosss2 stopped,apache1 and jbosss1 running )<br>
the problem is located exactly when one of the two nodes falls and the switch does not occurs<br>
Is there a specific shibboleth configugratoin on clustered environments?<br>
<br>
some information<br>
<br>
main application url is <a href="https://apps.domain.intra/apps" rel="noreferrer" target="_blank">https://apps.domain.intra/apps</a> <<a href="https://apps.domain.intra/apps" rel="noreferrer" target="_blank">https://apps.domain.intra/apps</a>> ( in fact the F5 ip)<br>
application contex is /apps<br>
<br>
apache in node1 use proxy conf<br>
ServerName apps1.domain.intra<br>
ProxyPass /apps AJP://apps1.domain.intra:8009/apps<br>
<br>
mod cluster is listening on port 7777<br>
Listen apps1.domain.intra:7777<br>
<VirtualHost apps1.domain.intra:7777><br>
DirectoryIndex disabled<br>
<Directory /><br>
Require all granted<br>
</Directory><br>
........<br>
<br>
ssl.conf file<br>
ServerName apps.domain.intra:443<br>
<br>
apache in node2 <br>
ProxyPass /apps AJP://apps2.domain.intra:8009/apps<br>
<br>
mod cluster is listening on port 7777<br>
Listen apps2.domain.intra:7777<br>
<VirtualHost apps2.domain.intra:7777><br>
DirectoryIndex disabled<br>
<Directory /><br>
Require all granted<br>
</Directory><br>
<br>
IDP ( Microsoft AD Azure ) config<br>
target url ( sig on url): <a href="https://apps.domain.intra/apps" rel="noreferrer" target="_blank">https://apps.domain.intra/apps</a> <<a href="https://apps.domain.intra/apps" rel="noreferrer" target="_blank">https://apps.domain.intra/apps</a>><br>
sp entity id : <a href="https://apps.domain.intra/shibboleth" rel="noreferrer" target="_blank">https://apps.domain.intra/shibboleth</a> <<a href="https://apps.domain.intra/shibboleth" rel="noreferrer" target="_blank">https://apps.domain.intra/shibboleth</a>> <br>
acs url: <a href="https://apps.domain.intra/Shibboleth.sso/SAML2/POST" rel="noreferrer" target="_blank">https://apps.domain.intra/Shibboleth.sso/SAML2/POST</a> <<a href="https://apps.domain.intra/Shibboleth.sso/SAML2/POST" rel="noreferrer" target="_blank">https://apps.domain.intra/Shibboleth.sso/SAML2/POST</a>><br>
<br>
shib conf ( same on both nodes)<br>
sp-metadata.xml<br>
<EntityDescriptor entityID="<a href="https://apps.domain.intra/shibboleth" rel="noreferrer" target="_blank">https://apps.domain.intra/shibboleth</a> <<a href="https://apps.domain.intra/shibboleth" rel="noreferrer" target="_blank">https://apps.domain.intra/shibboleth</a>>"<br>
<br>
<AssertionConsumerService<br>
Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"<br>
Location="<a href="https://apps.domain.intra/Shibboleth.sso/SAML2/POST" rel="noreferrer" target="_blank">https://apps.domain.intra/Shibboleth.sso/SAML2/POST</a> <<a href="https://apps.domain.intra/Shibboleth.sso/SAML2/POST" rel="noreferrer" target="_blank">https://apps.domain.intra/Shibboleth.sso/SAML2/POST</a>>"<br>
index="1" isDefault="true" xmlns="urn:oasis:names:tc:SAML:2.0:metadata"/><br>
<br>
Shibboleth2.xml<br>
<ApplicationDefaults entityID="<a href="https://apps.domain.intra/shibboleth" rel="noreferrer" target="_blank">https://apps.domain.intra/shibboleth</a> <<a href="https://apps.domain.intra/shibboleth" rel="noreferrer" target="_blank">https://apps.domain.intra/shibboleth</a>>"<br>
<br>
Thanks again for your help<br>
<br>
--<br>
<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>