Releasing an attribute based on client IP

[Cantor, Scott]

On 11/23/15, 3:29 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:


>
>The folks at Hathi-Trust are asking us to release an attribute on login to tell their SP that the logged in user is on a library computer (IP range). This, for some reason, seems wrong to me, releasing an attribute based on the IP and not the actual user, but maybe I'm just not thinking outside the box today.

It doesn't address back channel use of attributes, so we don't advise it, but if you're front-channel only, it's not really anything the IdP cares about preventing you from doing, if that's what you mean.

>Without writing some type of custom attribute resolver, is there an easy way to do this in V3?

Script, normally. I believe we're not actually injecting the servlet objects into the scripts, but we accomodated that need in 3.2 with the new customObjectRef capability [1].

Basically you can set customObjectRef="shibboleth.HttpServletRequest" and go to town.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition