Search code examples
spring-saml

Support for non-sticky sessions in spring-security-saml2-core?

I see from http://docs.spring.io/spring-security-saml/docs/1.0.0.RELEASE/reference/html/configuration-advanced.html#configuration-load-balancing that stickysessions are required when using a loadbalancer.

Is there any hope for support for non-sticky sessions in a future release?

-Kaj :)

Solution

  • There shouldn't be need for sticky sessions in case you replicate your HTTP sessions to all nodes in the cluster. It's also not needed in case you use IDP-initialized SSO without Single Logout. One more option is to add bean EmptyStorageFactory which removes certain validations based on sent AuthnRequest (like checking of InResponseTo field).

    There's always hope, but I don't think I'll be writing this anytime soon. Contributions welcome.