IdP to allow only users within given IP range to access a SP

[Manuel Haim]

Hi Stefano,

> We need - prior to authentication - a check done by the IdP on
> browser IP and SP being accessed.

I see two options here:

1) Similar to Jan Keirse's idea: Does the SP request a special attribute
which is needed to grant access? (e.g.
eduPersonEntitlement=urn:mace:dir:entitlement:common-lib-terms)
Then you could check the user's IP address and leave that attribute
blank if the user is not entitled to use the SP.

Please note that there may be a problem with Jan's code line
var ipAddress =
requestContext.getInboundMessageTransport().getPeerAddress() ;
... because if the SP requests the attributes via back-channel (SOAP),
then getPeerAddress() will return the SP's IP address (not the user's IP
address), see
https://bugs.internet2.edu/jira/si/jira.issueviews:issue-html/SIDP-269/SIDP-269.html

Alternatively, you may use our custom login handler (which stores the
user's IP address in the user's publicCredentials for later use in
attribute resolution):
http://www.staff.uni-marburg.de/~haimm/unimr-login.shib2.2011_11_21.zip
but please take care of this Security Advisory:
http://shibboleth.internet2.edu/secadv/secadv_20110718.txt).

2) If the above is no option, you must write an IdP plugin which blocks
the IdP's attribute forwarding based on the user's IP address (or other
attribute values). We use a customized copy of the uApprove filter
(ch.SWITCH.aai.uApprove.Intercepter) to accomplish this, i.e. users
lacking the
eduPersonEntitlement=urn:mace:dir:entitlement:common-lib-terms attribute
value are blocked and shown a no-access page.
I have just uploaded the jar file and the sources here if you want to
have a look:
http://www.staff.uni-marburg.de/~haimm/unimr-spaccessfilter.shib2.uapprove240.2013_08_22.zip


-Manuel