Re: [radext] Server identity and RFC7585bis

[Jan-Frederik Rieckers <[e-mail]>]

Hi Mark,

could you provide an example scenario for this? I can't really picture it.

My naïve understanding is that to phase a server out, you change the SRV 
records to point to a different server, then there should be a timeout 
for the dynamic lookup, and once this timeout triggers and the proxy 
gets the new server, it should redirect all traffic to the new and the 
old shouldn't see any traffic any more.

If it's something that is missing from RFC7585, then this might be 
another argument why we should work on a 7585bis document.

Cheers,
Janfred

On 10.04.24 09:58, Mark Grayson (mgrayson) wrote:
> As it relates to 7585, WBA recently had to clarify the same in terms of 
> cache TTL,
> 
> but also recommendation on maximum TCP lifetime for dynamic connections:
> 
> there are some scenarios where significant traffic between access providers
> 
> and identity providers means any idle timeout is never triggered and the
> 
> dynamic connection becomes persistent, which then prevents the identity
> 
> provider from gracefully terminating connections on an old server instance.
> 
>   * M

-- 
Herr Jan-Frederik Rieckers
Security, Trust & Identity Services

E-Mail: [e-mail] | Fon: [phone] | Fax: [phone]
Pronomen: er/sein | Pronouns: he/him
__________________________________________________________________________________

DFN - Deutsches Forschungsnetz | German National Research and Education 
Network
Verein zur Förderung eines Deutschen Forschungsnetzes e.V.
Alexanderplatz 1 | 10178 Berlin
https://www.dfn.de

Vorstand: Prof. Dr.-Ing. Stefan Wesner | Prof. Dr. Helmut Reiser | 
Christian Zens
Geschäftsführung: Dr. Christian Grimm | Jochem Pattloch
VR AG Charlottenburg 7729B | USt.-ID. DE 136623822