[Shib-Users] When restart apache do I restart shibboleth
csross
On solaris 10, when I restart or reload httpd.conf (after making changes to
the conf), do I have to restart the shibboleth daemon?
If I need to restart the shibboleth daemon, is there a sequence I should
follow when I need to change the apache httpd.conf? For example, should I
stop the shib daemon first, then make changes and restart/reload apache, the
start the shibd daemon?
Thank you very much.
--
View this message in context: http://n2.nabble.com/When-restart-apache-do-I-restart-shibboleth-tp4033268p4033268.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.
csross
csross wrote:
>
> On solaris 10, when I restart or reload httpd.conf (after making changes
> to the conf), do I have to restart the shibboleth daemon?
>
> If I need to restart the shibboleth daemon, is there a sequence I should
> follow when I need to change the apache httpd.conf? For example, should I
> stop the shib daemon first, then make changes and restart/reload apache,
> the start the shibd daemon?
>
> Thank you very much.
>
>
Adding on - it doesn't appear that I have to since I just did a graceful
restart of apache and shibboleth still responded.
What are the best practices and when do I HAVE to restart the shibd daemon?
Do I have to restart it if I made a change to the shibboleth2.xml file?
Thank you in advance.
--
View this message in context: http://n2.nabble.com/When-restart-apache-do-I-restart-shibboleth-tp4033268p4033354.html
Peter Schober
> On solaris 10, when I restart or reload httpd.conf (after making
> changes to the conf), do I have to restart the shibboleth daemon?
I'd say unless you change some fundamentals (such as the ServerName
directive, etc.) making "ordinary" changes to httpd's config will
/not/ require a shibd restart (I just suppose changing ServerName
will, but I don't /know/). Just HUP'ing/reloading httpd should
suffice (after `apachectl -t`, or course ;)
Same is true even for changing Shibboleth's config files in many
cases: Some changes will apply immediately -- e.g. setting
showAttributeValues="true" on the Session handler.
Others will be effective for new sessions, e.g. changing attribute
mapping/filtering will not affect already mapped/filterd attributes.
Yet other setting will require a restart of the shibd, e.g. changing
from an UnixListener to a TCPListener or changing the acl attribute on
a TCPListener.
But usually there's no need to restart one (shibd) when making changes
to the other (httpd).
cheers,
-peter
Peter Schober
> Yet other setting will require a restart of the shibd, e.g. changing
> from an UnixListener to a TCPListener or changing the acl attribute
> on a TCPListener.
The former may be one of the few cases where you'd need to restart
httpd after making changes to shibboleth2.xml, since it deals with the
way httpd/mod_shibd communicates with shibd. This is not typical for
day to day changes.
-peter
Scott Cantor
> * csross <cr...@hccs.com> [2009-11-19 18:39]:
>> On solaris 10, when I restart or reload httpd.conf (after making
>> changes to the conf), do I have to restart the shibboleth daemon?
If you restart the daemon without using a database for caching, you lose
every active session, so no, you should never do that unless you have to.
> I'd say unless you change some fundamentals (such as the ServerName
> directive, etc.) making "ordinary" changes to httpd's config will
> /not/ require a shibd restart (I just suppose changing ServerName
> will, but I don't /know/). Just HUP'ing/reloading httpd should
> suffice (after `apachectl -t`, or course ;)
Depends on why it's changing and what's depending on it but in general any
changes to ServerName would align to changes to other dynamically changeable
settings, the exception being on IIS.
> Same is true even for changing Shibboleth's config files in many
> cases: Some changes will apply immediately -- e.g. setting
> showAttributeValues="true" on the Session handler.
In general, everything above RequestMapper is init only and everything else
is dynamic (aside from changes that only affect new sessions). I'm probably
missing an exception to that, but offhand that's close to a rule.
-- Scott
csross
Thank you.
In the httpd.conf I want to add a non-shib vhost or change non-shib related
ServerName items so it seems I do not need to .
In shibboleth2.xml , I want to add an IP to <Handler type="Status"
Location="/Status" acl=.
From what you are saying I probably don't need to restart shib in either
case.
Thank you for your help.
--
View this message in context: http://n2.nabble.com/When-restart-apache-do-I-restart-shibboleth-tp4033268p4033784.html
Bajnok Kristóf
wrote:
else
> is dynamic (aside from changes that only affect new sessions). I'm
probably
> missing an exception to that, but offhand that's close to a rule.
Some time ago I replaced the keys/certificates and was having hard time
until I figured out that shibd restart was necessary. I don't remember the
details, so I could be missing something else.
Kristof
Scott Cantor
> Some time ago I replaced the keys/certificates and was having hard time
> until I figured out that shibd restart was necessary. I don't remember the
> details, so I could be missing something else.
Necessary prior to 2.2 or so, not any longer.
-- Scott