X-Forwarded-For on the IdP

[Simon Lundström]

On Thu, 2012-02-09 at 15:19:03 -0500, Elliot Kendall wrote:
> On 2012-02-09 15:10:41 -0500, Ryan Suarez wrote:
> > On 12-02-09 02:23 PM, Elliot Kendall wrote:
> > > Our IdPs are behind a load balancer that sends real client IP addresses
> > > in the X-Forwarded-For header. I want to put client IP into the IdP
> > > logs, but %mdc{clientIP} gives me the load balancer's address.
> > >
> > > On the SP side, you can do "ShibRequestSetting REMOTE_ADDR
> > > X-Forwarded-For" in Apache conf, but I haven't been able to find
> > > anything about the IdP other than a feature request from 2010 -
> > > https://lists.internet2.edu/sympa/arc/shibboleth-dev/2010-05/msg00017.html
> > >
> > > Is there any way to do what I want? If not, how should I go about
> > > requesting it as a new feature?
> > 
> > Why not point the default gateway of IdP to the load balancer, and then 
> > disable address translation for IdP traffic on the load balancer?  We do 
> > this for services like smtp and ldap behind F5 BIG-IPs to preserve 
> > source IP.
> 
> We're certainly moving in that direction, but I expect it'll take a
> while to get the IdPs to that point. For now, I'm looking into using
> Tomcat's Remote IP Valve to get what I want.

One other option is to use DSR, Direct Server Return, to offload your
loadbalancer. With an F5 BIG-IP load is not an issue, in our experience,
but it's certainly an possibility (but an weird one, IMO).

- Simon