RE: [saml-dev] Load balancing with SAML2

["Scott Cantor" <cantor.2@osu.edu>]

> "Session management" (getting a user to the right server behind a load
> balancer) is a well known problem for load balancing systems and should be
> able to solve this without the need for any extra-special SAML glue.

That relies on sticky sessions. Some load balancers don't support that, and
I know from speaking to other people (one example of which occurred
literally two days ago) that they aren't universally viewed as desirable, so
in fact a good implementation does tend to have to deal with it, or at least
limit its use of state as much as possible.

I think (seeing as I did it) that it's practical to implement a SAML SP
itself without any state, aside from the state required to implement actual
user session management, which is something some API-based SPs don't provide
anyway.

-- Scott