IdP to allow only users within given IP range to access a SP

[Douglas E. Engert]

On 8/21/2013 10:51 PM, Stefano Zanmarchi wrote:
> Thank you for the hint Ian, but IdPAuthIP is not the solution because the SP expects to receive  attributes so username/password authentication is a must. Firewalling is not an option because other
> SPs dont have this IP restriction.
> We need - prior to authentication - a check done by the IdP on browser IP and SP being accessed.

This could be a show stopper. Since the IDP is doing SSO, the user may have authenticated
by going to a different SP earlier. The IDP will use the previous cookie from the browser
for the assertion and then gets attributes for the second SP. As Jan Keirse pointed out
the IDP can choose to send some don't-allow-this-user attribute or no attributes.
But the IDP still sends an assertion. So it depends on what the SP will do with the
assertion without the normal attributes it expects.

This thread,
  http://shibboleth.1660669.n2.nabble.com/Restricting-Authentication-to-a-subset-of-Users-td6375260.html

is similar in that we wanted to restrict some user accounts from using Shibboleth
and have the same problem of what to do with sending an assertion indicating
don't-allow-this-user or an assertion with no attributes to an SP. There does not
appear to be any way from the attribute-resolver or attribute-filter to send a
not successful assertion to the SP, or a way to send a page to the user's browser
saying not allowed.

We have been using the advise of sending an assertion with no attributes.

> Any help here would be greatly appreciated.
> Stefano
>
> Il giorno 21/ago/2013 23:56, "Ian Rifkin" <irifkin at brandeis.edu <mailto:irifkin at brandeis.edu>> ha scritto:
>
>     Hi Stefano,
>
>         we need to limit access to a given SP to users within a given IP range.
>         We can only work on the IdP side.
>
>
>     I'm not an expert, so maybe someone else can chime in, but I think it would depend on your configuration. You can put IP restrictions in webserver and firewall software, but you can't do that if
>     you use the IdP for other SPs that don't have this IP restriction. If you have a custom auth piece it looks like you can read about https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthIP.
>     Or perhaps attempt something more fancy/custom.
>
>     Taking a step back, how do you currently do authentication? And what does the SP expect to receive back from you (do they do any authorization or does the SP just assume if they get a reply they
>     are good?).
>
>     Regards,
>     Ian
>
>     --
>     To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444