IP address mismatch issues

[Russell Beall]

With the upgrade to 2.5 we are seeing an increasing occurrence of IP address mismatch issues from users coming from certain networks.  It is starting to look like these networks are assigning one IP address when the user is accessing the shibboleth IdP and then another when the user is accessing the SP server.  This is not the simpler case where a loadbalancer was put in the way and it is blocking Client IP, but rather, two different IP addresses belonging to the networking provider are shown in the logs.

This causes session creation looping because the existing session continually gets rejected for Client IP mismatch.

Has anyone else started seeing this issue and possibly come across a solution?

Is this some kind of networking practice that is supposed to happen for certain networks?

I know I can disable the requirement at the SP, but I'd rather find a better solution than just breaking one of the locks.

Thanks,
Russ.