[JIRA] Created: (SSPCPP-488) No way to get client address set for ExternalAuth sessions

[Scott Cantor (JIRA)]

No way to get client address set for ExternalAuth sessions
----------------------------------------------------------

                 Key: SSPCPP-488
                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-488
             Project: Shibboleth SP - C++
          Issue Type: Bug
          Components: Session Cache
    Affects Versions: 2.5
            Reporter: Scott Cantor
            Assignee: Scott Cantor
            Priority: Blocker
             Fix For: 2.5


The external-auth handler in loopback mode has no way to get the address set for the client session other than the usual request.getClientAddress call inside the session cache, so it's set to 127.0.0.1.

If you side-step the address lookup using the REMOTE_ADDR property and use an HTTP header, then the address check inside the handler itself to limit access breaks, obviously.

May need to use deprecated session cache method for now to set the address manually or provide an additional API somewhere.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira