IP address mismatch issues

[Wessel, Keith William]

Russ,

We ran into this with one of our campuses that's completely behind a firewall and using NAT. Their firewall was assigning an IP from the pool based on what server it was going to, so the IDP and SP, being separate servers, would see different addresses.

The SP V2.5 session docs:

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions

suggest that consistentAddress is just about as good as checkAddress in shibboleth2.xml but with the added benefit that it's less likely than checkAddress to block legitimate access.

I know that turning off checkAddress to solve this problem may seem like a less than ideal solution at first, but when you consider that checkAddress is doing exactly what it was designed to do, it makes sense, and consistentAddress does just as good of a job.

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Russell Beall
Sent: Thursday, May 23, 2013 1:49 PM
To: Shib Users
Subject: IP address mismatch issues

With the upgrade to 2.5 we are seeing an increasing occurrence of IP address mismatch issues from users coming from certain networks.  It is starting to look like these networks are assigning one IP address when the user is accessing the shibboleth IdP and then another when the user is accessing the SP server.  This is not the simpler case where a loadbalancer was put in the way and it is blocking Client IP, but rather, two different IP addresses belonging to the networking provider are shown in the logs.

This causes session creation looping because the existing session continually gets rejected for Client IP mismatch.

Has anyone else started seeing this issue and possibly come across a solution?

Is this some kind of networking practice that is supposed to happen for certain networks?

I know I can disable the requirement at the SP, but I'd rather find a better solution than just breaking one of the locks.

Thanks,
Russ.


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net