Hi

I'm currently putting together plans to update our IdP infrastructure and want to add in automatic failover.   We currently have a manual failover to a secondary IdP, should it ever be needed (which since the move to Shib 2 many many moons ago it hasn't!).   However I would like to push Shib authentication for some high profile services and without having a demonstrable auto failover mechanism this won't be well received.

Because Shibboleth is stateful, if you are going to loadbalance cluster it you need a mechanism for sharing state information, the shibboleth documentation says:  "By default the Shibboleth team recommends the use of Terracotta as the mechanism for doing this"  which is a shame because I have it on high authority that "I think you'd be insane to consider it."....    I know a lot of people have found Terracotta to have, itself, caused shib outages.

Without state sharing you need to go for a hot standby rather than loadbalanced approach, but unfortunately our existing Cisco content switch (which is well overdue for replacement) cannot do this.   

So,  I'd be interested to hear from anyone who is doing hot standby with their Shibboleth IdP  (i.e. if IdP1 is responding always use it, if it fails the test switch to IdP2)  and what type of hardware loadbalancer you're using at the front to do this.

Cheers
Andy