X-Forwarded-For on the IdP

[Elliot Kendall]

On 2012-02-09 15:10:41 -0500, Ryan Suarez wrote:
> On 12-02-09 02:23 PM, Elliot Kendall wrote:
> > Our IdPs are behind a load balancer that sends real client IP addresses
> > in the X-Forwarded-For header. I want to put client IP into the IdP
> > logs, but %mdc{clientIP} gives me the load balancer's address.
> >
> > On the SP side, you can do "ShibRequestSetting REMOTE_ADDR
> > X-Forwarded-For" in Apache conf, but I haven't been able to find
> > anything about the IdP other than a feature request from 2010 -
> > https://lists.internet2.edu/sympa/arc/shibboleth-dev/2010-05/msg00017.html
> >
> > Is there any way to do what I want? If not, how should I go about
> > requesting it as a new feature?
> 
> Why not point the default gateway of IdP to the load balancer, and then 
> disable address translation for IdP traffic on the load balancer?  We do 
> this for services like smtp and ldap behind F5 BIG-IPs to preserve 
> source IP.

We're certainly moving in that direction, but I expect it'll take a
while to get the IdPs to that point. For now, I'm looking into using
Tomcat's Remote IP Valve to get what I want.

-- 
Elliot Kendall
Information Security Specialist
Office of Information Technology
Emory University and Healthcare