Maksim, Most (all) of the ticket registries should be able to handle mulit node CAS. Perhaps your registry configuration is incomplete. What is your current config?
Ray On Tue, 2020-01-14 at 05:23 -0800, 'Maksim Kopeyka' via CAS Community wrote: The main problem on multi-node environment is keycloak sends a POST request to SLO endpoint of CAS but CAS won't ask username/password next time i.e. previous session is alive. What the best practice to solve such problem? We have tried to do a broadcast of POST request to SLO endpoint to all nodes of CAS environment but keycloak has had an exceptions related to java.net.SocketException: Connection reset. Maybe Hazelcast-Ticket Registry may help us? When there is only one keycloak and one CAS server Everything works as expected: * Keycloak will send the sign out POST request to the only CAS server. * The only CAS server will then log user out, terminate the existing connection, and ask about username/password for new authentication requests. When there are multiple CAS and keycloak servers * User connects to keycloak server 1 (K1) with a persistent connection. * K1 redirects user to CAS server 1 (C1) for authentication. * User connects to C1 with a persistent connection and logs in. * C1 redirects the user to the keycloak VIP (K1 in this case, because of the persistent connection between user and K1). * C1 creates a connection to the keycloak VIP, sends some data, and then terminates the connection. * User click on the "Sign Out" button, and K1 logs user out. * Instead of redirecting user to CAS for a log out (which will put user on C1 due to the persistent connection between user and C1), K1 sends a POST request to the CAS VIP. * Because this is a new connection from K1 to CAS and there are multiple servers under the CAS VIP, K1 may connect to CAS server 2 (C2) and send the sign out POST request to that server. * At this time, user still has a persistent connection with C1. * When the user hit the CAS VIP again, the persistent connection between user and C1 is utilized. * C1 knows the user is already logged in hence it does not ask about username/password again. C1 then sends data to the keycloak VIP and redirects user to keycloak. -- Ray Bon Programmer Analyst Development Services, University Systems 2507218831 | CLE 019 | [email protected]<mailto:[email protected]> I respectfully acknowledge that my place of work is located within the ancestral, traditional and unceded territory of the Songhees, Esquimalt and WSÁNEĆ Nations. -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/39d44391e4f8a2050543b526b57309219b7d8b3a.camel%40uvic.ca.
