Federation cannot be configured in HA mode

[Boris Bobrov]

Because of our haproxy configuration, it is not possible to use mod-shib to enable federation.

This happens because shibboleth stores some information in a local database between requests.

This can be fixed with one of the changes:

1. Make shibboleth use mysql. My opinion is that it is an overkill. It is also not deployer-friendly: one would have to create a database, tables, schema etc, which is a terrible thing to figure out.

2. Use sticky sessions in haproxy. We need a small window to let the user make a request to keystone, authenticate at his IdP and get back to keystone. The window should be 2 minutes. We can try to lower this value in future.

Although we don't officially support federation in 8.0 release, our deployers already want it.

[Boris Bobrov (bbobrov)]

I suggest to add this value to haproxy configuration:

  stick on src
  stick-table type ip size 200k expire 2m

[Boris Bobrov (bbobrov)]

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPClustering -- for more information about shibboleth behind HA.

[Boris Bobrov (bbobrov)]

No, this is not public security.

[Max Yatsenko (myatsenko)]

The patch for solving the issue:
https://review.openstack.org/#/c/261762

[Max Yatsenko (myatsenko)]

https://review.openstack.org/#/c/261762 was merged.

[Alexander Petrov (apetrov-n)]

Verified on MOS 9.0 build 106
haproxy configuration is done correctly

/etc/haproxy/conf.d/020-keystone-1.cfg

listen keystone-2
  bind 192.168.0.2:35357
  http-request set-header X-Forwarded-Proto https if { ssl_fc }
  option httpchk GET /v3
  option httplog
  option httpclose
  option forwardfor
  stick on src
  stick-table type ip size 200k expire 2m
  server node-1 192.168.0.3:35357 check inter 10s fastinter 2s downinter 2s rise 30 fall 3
  server node-2 192.168.0.7:35357 check inter 10s fastinter 2s downinter 2s rise 30 fall 3