IdP session for client with private IP

[David Bantz]

On Wed, 22 May 2013, at 14:46 , "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>> I'm trying to guess what effect that change (clients using a different IP
>> address to IdP and SP) will have.  The following suggests that at least some
>> SPs will be using the default setting to check and refuse to create an SP
>> session.
> 
> It is true that any number of them may, but that setting only defaults to true now in the sense that it is true if absent. The files shipped with the software have for many releases now set it to false explicitly because that's what the community preferred.

Good to know - thanks.  

> But I would not by any means suggest that nothing will break; some things will. You will not know which unless you test things ahead of time, of course.

Network folks have suggested testing in our current environment from a client with dual network interfaces and use route to route to external SP addresses with one client IP address and internally (to the IdP) using the other client IP address.

db

> 
> -- Scott

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130522/0d424d0f/attachment.html