Shibboleth 2.5 External Auth handler

[Cantor, Scott]

On 8/2/12 4:05 PM, "Christopher J. Hubing" <cjh at psu.edu> wrote:
>
>I do have checkAddress="false" in the ApplicationDefaults element, so
>the IP address shouldn't matter.

If there's nothing logged indicating I'm right, then I will entertain
other possibilities, but that's not what checkAddress means, the setting
you want is consistentAddress (which is suicide to turn off).

I'm verifying that it will work as intended, but the missing bit to
configure should be to get REMOTE_ADDR set for the handler path:

<Location /Shibboleth.sso/ExternalAuth>
ShibRequestSetting REMOTE_ADDR X-Forwarded-For
</Location>

(or RequestMap equiv, and with whatever header is preferred)

I would make that happen implicitly if I could, but I don't have a way to
do that from within the handler itself without writing more code than it's
worth.

-- Scott