Releasing an attribute based on client IP

[Wessel, Keith]

Thanks, Scott. At least this buys me a few weeks to say "we can't do it yet" until I've upgraded to 3.2 to debate the merits of it with them and our security folks.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, November 23, 2015 2:39 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Releasing an attribute based on client IP

On 11/23/15, 3:29 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:


>
>The folks at Hathi-Trust are asking us to release an attribute on login to tell their SP that the logged in user is on a library computer (IP range). This, for some reason, seems wrong to me, releasing an attribute based on the IP and not the actual user, but maybe I'm just not thinking outside the box today.

It doesn't address back channel use of attributes, so we don't advise it, but if you're front-channel only, it's not really anything the IdP cares about preventing you from doing, if that's what you mean.

>Without writing some type of custom attribute resolver, is there an easy way to do this in V3?

Script, normally. I believe we're not actually injecting the servlet objects into the scripts, but we accomodated that need in 3.2 with the new customObjectRef capability [1].

Basically you can set customObjectRef="shibboleth.HttpServletRequest" and go to town.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net