Attribute filter requirement based on client IP-address

[Cantor, Scott]

On 5/6/13 3:56 PM, "Philip Brusten" <philip.brusten at icts.kuleuven.be>
wrote:

>Well I didn't fully explained... Of course you cannot add attributes in
>the attribute-filter, but I think the filter would be a better place to
>implement this IP-based logic. Because basically what you are doing is
>filtering on the principal's attributes based on the context, which in
>this case is an IP-address.

Yes, but the code they wrote *creates* attributes based on address, it
doesn't filter based on it. You can't do what they did in a filter.

>Is this a yes for 'am I right' or for  'yes, you can get the IP-address
>from the ShibbolethFilteringContext' :-)

Yes, you can get it. I don't speak that Javascript dialog very well, but
in Java, you get the inbound transport object from:

ShibbolethFilteringContext.getAttributeRequestContext().getInboundMessageTr
ansport()

Then do:


HttpServletRequest httpRequest =
	((HttpServletRequestAdapter)inTransport).getWrappedRequest();


-- Scott