0

For availability purpose, I have a redundant setup with 2 fronts and 2 backs. Each front hosts a web server, serving the same pages. Each front runs a instance of Shibboleth SP, redirecting to the same IdP. Both fronts are behind a load balancer exposing a unique public address. The Load Balancer will have a session affinity set on the shibboleth cookie.

On the first connection, the user is not authentified and Shibboleth SP redirects to the ADFS with a relay state. After authentication, the ADFS redirects to the LB public address.

Problem is, there is no shibboleth cookie yet. Can the redirection be handled by either instance of Shibboleth SP? If not, how to properly manage 2 redundant instances of Shibboleth SP as described?

Thanks!

Joel
  • 669
  • 7
  • 25

1 Answers1

1

ADFS redirects the user back to the LB address which passes along the SAMLResponse to whatever node it selects, at which point the SP (either) will see a valid SAMLResponse and initiate a cookie. If the user gets pinged to another SP node, that cookie won't be seen by the SP as valid unless both SPs are sharing a common session store, just as a database, and it'll kick through SSO again. Usually session stickyness would be pegged to user's IP so that they always (or almost always) get redirected to same SP instance... and on the offchance their affinity changes they'll still have a valid IDP session and shouldn't see the login page.

A lot of this depends upon your application and how that's built, too... see: https://wiki.shibboleth.net/confluence/display/SP3/Clustering... TL;DR: avoid clustering the SP by leveraging it on a single entry point since it's lightweight (problematic but what I'd usually recommend), or live with sharing a session DB (which has a lot of it's own problems).

Kellen Murphy
  • 620
  • 6
  • 13
  • 1
    Thanks for your answer. The LB is configured with session affinity on the Shibboleth SP cookie, so once it's issued, it won't be a problem. My question is rather on the redirection from the ADFS : will the SAML Response been handled by the second node if the saml request has not been issued by it? I did some tests, it seems it is the case though. – Joel Jun 10 '20 at 03:58
  • 1
    Yep. This is actually done in order to be compatible with IdP-initiated SSO, where the SP endpoint will just get a SAMLResponse out of the blue from the IdP. – Kellen Murphy Jun 12 '20 at 20:16