X-Forwarded-For on the IdP

[Ryan Suarez]

On 12-02-09 02:23 PM, Elliot Kendall wrote:
> Our IdPs are behind a load balancer that sends real client IP addresses
> in the X-Forwarded-For header. I want to put client IP into the IdP
> logs, but %mdc{clientIP} gives me the load balancer's address.
>
> On the SP side, you can do "ShibRequestSetting REMOTE_ADDR
> X-Forwarded-For" in Apache conf, but I haven't been able to find
> anything about the IdP other than a feature request from 2010 -
> https://lists.internet2.edu/sympa/arc/shibboleth-dev/2010-05/msg00017.html
>
> Is there any way to do what I want? If not, how should I go about
> requesting it as a new feature?

Why not point the default gateway of IdP to the load balancer, and then 
disable address translation for IdP traffic on the load balancer?  We do 
this for services like smtp and ldap behind F5 BIG-IPs to preserve 
source IP.