[JIRA] Resolved: (SSPCPP-488) No way to get client address set for ExternalAuth sessions

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-488?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-488.
---------------------------------

    Resolution: Fixed

http://svn.shibboleth.net/view/cpp-sp?rev=3747&view=rev

Also added event logging.

Documentation updated.

> No way to get client address set for ExternalAuth sessions
> ----------------------------------------------------------
>
>                 Key: SSPCPP-488
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-488
>             Project: Shibboleth SP - C++
>          Issue Type: Bug
>          Components: Session Cache
>    Affects Versions: 2.5
>            Reporter: Scott Cantor
>            Assignee: Scott Cantor
>            Priority: Blocker
>             Fix For: 2.5
>
>   Original Estimate: 4 hours
>  Remaining Estimate: 4 hours
>
> The external-auth handler in loopback mode has no way to get the address set for the client session other than the usual request.getClientAddress call inside the session cache, so it's set to 127.0.0.1.
> If you side-step the address lookup using the REMOTE_ADDR property and use an HTTP header, then the address check inside the handler itself to limit access breaks, obviously.
> May need to use deprecated session cache method for now to set the address manually or provide an additional API somewhere.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira