Problem with client ip address changing

[Viitanen Viljo]

Hello all,

We have recently seen a few cases where the client side (browser) ip address changes on almost all requests. Obviously this prevents shibboleth idp from working, because client address is checked. However, the check causes weird stuff to happen: the idp lets the login go on to the sp, but without any attributes (in this case, eppn, cn and mail but it's irrelevant) except a static attribute that is unconditionally given to all  (we have a local "logout url" parameter in the Finnish Haka federation).

log entries in process log are like this:

x:x:x.x - ERROR [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:x] - Client sent a cookie from address x.x.x.33 but the cookie was issued to address x.x.x.38

(so, the code printing this is at http://svn.shibboleth.net/view/java-shib-idp2/tags/2.3.8/src/main/java/edu/internet2/middleware/shibboleth/idp/session/IdPSessionFilter.java?revision=3115&view=markup#l182 )

Any advice on how to deal with this?

The current behavior is unacceptable, as the various SP's don't quite know what to do with a situation where they get a successful login without any attributes they need. I'd rather the idp to issue an error to the user, and not let the user proceed to SP.

For the record, we are also using the uApprove plugin.

--
Viljo Viitanen
University of Jyväskylä

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121113/ceb6a00a/attachment-0001.html