Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Don't think "avoiding reliance on any server-side state" is exactly correct

...

An alternative to this approach is to forgo some features (including one that isn't even supported yet) in return for decreased complexity and increased reliablity by avoiding reducing reliance on any shared server-side IdP state.

Use of a stateless IdP login handler does not make a deployment completely stateless.  The login context is still persisted using server-side state which must be present through the process beginning with the receipt of an AuthnRequest and ending with the issuance of a response.  There must be either short session stickiness to associate a client with a single node for however long the login process may take(~5 minutes), or replication of the IdP session object itself using a stateful clustering mechanism.

...