disclosure of IP address in cookie

[Cantor, Scott]

> I the source code I see that the IP address is determined by
> "httpRequest.getRemoteAddr()",
> which according to my experiences, returns the IP address of the last proxy.
> I found no attempt to evaluate any X-Forwarded-For headers.

It's not supported. I believe some Java containers may have support for that directly, and that is a better approach than forcing every application to implement a look-aside, but no, the IdP doesn't.

I believe the other "Java" way of doing it is with a servlet filter that overrides getRemoteAddr, which you could build trivially.

> The same is true for the IP addresses in the SAML-Assertion.
> They refer to our reverse proxy instead of the client IP.
> But  I did not find a way to exclude them from the Assertion.

There isn't one I'm aware of.

-- Scott