SPClusteringByProxy

This is a descrption of a technique to support limited clustering of the Shibboleth V3 SP (or V4 Agent) using Apache proxying and rewrite capabilities to avoid the need for short-term session affinity in a load balancer. This is useful if the SP/Agent is strictly used to gateway into a long-lived application session that has some other clustering solution.

This is only a guide. Your installation and experience will differ.

Assume an implementation like this:

• You have several hosts supporting an application.

  • App is: 'app.example.edu'

  • Hosts are: 'srv1.s.example.edu', 'srv2.s.example.edu', 'srv11.s.example.edu'.

• To initiate a session your app redirects users to, say, "/login/...", a Shib protected location, where you generate an application session (with cookie) and redirect users back to "/app/...".

So, the accesses during a login are:

1. (user needs login)

2. /login/...

3. (user dialog with an IdP)

4. /Shibboleth.sso/...

5. /login/...

6. (back to the app with a session)

For the shibboleth part of the login to work '4' and '5' have to be on the same host.  Starting with about version 2.4 we cannot proxy '4'.  Its verification of server name is not optional.  So we have to proxy the return to the login ('5').

SP Configuration

Enable apache rewrites

Disable Address Checking

The proxied requests will come from the peer host, not the browser, so address checking must be fully disabled. This is a risk you are assuming with this solution, but is mitigated by the short term nature of the session.

With V3, the SP’s configuration must include:

With V4, the checkAddress setting is managed by the Hub, while consistentAddress is a Content Setting.

Choose a login path

For this example we'll use "/login".  You could also use "/secureloign", for example, for 2-factor logins.  Note that we don't protect the 'logiin' path with shibboleth.  Instead we protect a hidden path.  Call it "/login-shib".

Choose an 'in-progress' cookie

For this example we'll use "splogin".

Notify peers when the local host processes the /Shibboleth.sso

Set the appropriate cookie.  And clear it when its been used.

This for host srv1:

Similar configuration for the other hosts.

Proxy logins started on peer hosts

Detect both by cookie and path.  This again for host srv1.

We need to detect the login path and proxy to the host that processed the /Shibboleth.sso.

Place similar configurations on the other hosts.

Rewrite unproxied logins to the protected path

This is to catch the initial redirect to login.

Protect the real shib login path

Any require lines should be OK.

Let shibboleth silently handle the other host login paths.

When handling the redirect from /Shibboleth.sso we need to gather the shib attributes.  This has to be just "require shibboleth".

Handling the rare case of already logged in users hitting the login path

If a user has a shib session and hits the /login/ path they skip all the login business and go directly to /login-shib/, which probably doesn't exist. You can handle this by creating a (web-root)/login-shib/ directory with an index.html that redirects immediately to, say, '/'.

Testing

I use webisoget to test the proxy setup.  Use its '-maxhop 1' option to single step through the many login redirections.  You have to use your /etc/hosts file to direct the requests to particular hosts.  The '-map' option won't work because libcurl caches mapped dns addresses and there's no way to prevent that (short of editing libcurl).  The /etc/hosts file works well, though.  You may want to increase the lifetime of your cookies during testing.