disclosure of IP address in cookie

[Peter Schober]

* Gruber Bernhard SAI sIT <Bernhard.Gruber at s-itsolutions.at> [2013-07-08 15:07]:
> But in our environment it includes the IP address of the reverse
> proxy [...]
> The same is true for the IP addresses in the SAML-Assertion.
> They refer to our reverse proxy instead of the client IP.

So your deployment is actually broken in at least two regards:

You don't have the client's IP address in your IdP's audit.log (having
them in httpd might not always suffice on a busy server).

And by writing the wrong IP address into all SAML assertions you
effectively prevent all federated SPs from performing consistency
checks on IP adresses (IP address the IDP saw vs. IP address the SP
sees).
-peter