[Nate Klingenstein]

Roger,

The default configuration of the SP will associate a user session with an IP address in order to make it more difficult to hijack a session by stealing and playing a cookie(consistentAddress).  A stronger check that checks the user's IP when interacting with the IdP against the IP used when interacting with the SP is disabled by default(checkAddress).

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions

You're likely running into the first check.  It's probably happening now and not before due to some change on the network where your users come from.  Shibboleth doesn't use 207.x or 173.x or anything else; it's your users' IP address, as seen by the SP, that is changing.

It's good to leave that check enabled if you can, but if your environment is such that you can't, you can turn it off.  If you do turn it off, make sure your service is only accessible over https:// and that the session cookies it sets are marked HttpOnly and secure, or else session hijacking becomes really trivial.

Thanks,
Nate.

On Jun 10, 2013, at 19:34 , Roger Jagoda wrote:

> Shibboleth Community,
> 
> We are seeing these warnings recently. Is this a concern? We only see
> errors like these maybe 2-3 times per hour:
> 
> (IPs changed)
> 
> 2013-06-10 11:07:13 WARN Shibboleth.SessionCache [14892]
> shib_check_user: client address mismatch, client (173.0.2.6), session
> (207.0.0.2)
> 2013-06-10 11:07:13 WARN Shibboleth.ServiceProvider [14892]
> shib_check_user: error duringsession lookup: Your IP address
> (173.220.22.106) does not match the address recorded at the time the
> session was established.
> 
> 2013-06-10 11:07:22 WARN Shibboleth.SessionCache [14904]
> shib_check_user: client address mismatch, client (173.0.2.6), session
> (207.0.0.2)
> 2013-06-10 11:07:22 WARN Shibboleth.ServiceProvider [14904]
> shib_check_user: error duringsession lookup: Your IP address
> (173.0.2.6) does not match the address recorded at the time the
> session was established.
> 
> 
> The 173 address is certainly ours, but I do not see what the switch to
> the 207 address accomplishes? Is this a common occurrence? There does
> not appear to be any effect on the SP Service. What does this warning
> mean?
> 
> 
> --RJ
> 
> ====================================
> 
> Roger Jagoda
> rberryj3 at gmail.com
> ==============================================
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>