> What I would like, but not sure if it is possible, is to have Shibboleth
> fallback to calculating EduPersonTargetedID/PersistentID if the DB fails
> (for whatever reason). That would avoid having to set up some form of DB
> resilience/replication.
>
> No idea if that is possible.
To start with you might want to investigate FailoverDataConnectors (documented at https://wiki.shibboleth.net/confluence/display/SHIB2/ResolverRDBMSDataConnector, but available to all data connectors). However that’s only half of the story and there is no equivalent for PrincipalConnectors which would render you exposed to hard to diagnose failures in SAML1 conditions (and all other attribute pull, which might be a big deal if you are exploiting StoredNameIDs). So then you'd end up playing tricks with NameID formats which would involve you in some tricky scripting and attribute release and my strong suggestion is that you don't want to go that route - you'd be at risk of ending up with a system that was less reliable.
You might want to take the question over the shib-users list where a lot of people with huge deployment experience hang out.
/R
|