Attribute filter requirement based on client IP-address

[Philip Brusten]

On 6/05/2013 15:53, Cantor, Scott wrote:
>> First of all, I hate to ask this question, because I think it's archaic
>> to authorize based on IP-addresses, but for some reason vendors still
>> don't allow off-campus access to their resources.
> It's basically the standard state of affairs in the US.
>
>> I saw the UKFederation made an extension to the resolver, called User
>> Agent Based Attributes, which made it possible to statically add
>> SAML-attributes based on the client's IP-address.  But I don't
>> understand why they didn't use the attribute filter to accomplish this.
> You can't add attributes in a filter, if I'm understanding you.
Well I didn't fully explained... Of course you cannot add attributes in 
the attribute-filter, but I think the filter would be a better place to 
implement this IP-based logic. Because basically what you are doing is 
filtering on the principal's attributes based on the context, which in 
this case is an IP-address.
>> So I was wondering if it is possible to filter the attributes based on
>> the client's IP-address in the PolicyRequirementRule.
>> I thought I could accomplish this with
>> https://wiki.shibboleth.net/confluence/display/SHIB2/IdPFilterRequirement
>> Script,
>> but the ShibbolethFilteringContext doesn't seem to provide access to the
>> IP-address of the client, am I right?
> Front channel, yes, back channel, the answer is "yes", but it's implemented in such a way that I would be deeply suspicious of that code.
>
Is this a yes for 'am I right' or for  'yes, you can get the IP-address 
from the ShibbolethFilteringContext' :-)
If the latter is right, could you give me a pointer in the right direction?

Philip