Attribute filter requirement based on client IP-address

[Cantor, Scott]

> First of all, I hate to ask this question, because I think it's archaic
> to authorize based on IP-addresses, but for some reason vendors still
> don't allow off-campus access to their resources.

It's basically the standard state of affairs in the US.

> I saw the UKFederation made an extension to the resolver, called User
> Agent Based Attributes, which made it possible to statically add
> SAML-attributes based on the client's IP-address.  But I don't
> understand why they didn't use the attribute filter to accomplish this.

You can't add attributes in a filter, if I'm understanding you.

> So I was wondering if it is possible to filter the attributes based on
> the client's IP-address in the PolicyRequirementRule.
> I thought I could accomplish this with
> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirement
> Script,
> but the ShibbolethFilteringContext doesn't seem to provide access to the
> IP-address of the client, am I right?

Front channel, yes, back channel, the answer is "yes", but it's implemented in such a way that I would be deeply suspicious of that code.

-- Scott