Releasing an attribute based on client IP

[Peter Schober]

* Wessel, Keith <kwessel at illinois.edu> [2015-11-23 21:32]:
> The folks at Hathi-Trust are asking us to release an attribute on
> login to tell their SP that the logged in user is on a library
> computer (IP range). This, for some reason, seems wrong to me,
> releasing an attribute based on the IP and not the actual user, but
> maybe I'm just not thinking outside the box today.

IMO if they insist on IP checks they should check the IP address
themselfs, against IP ranges you transmit to them somehow. That could
be done out of band (the ordinary way; sending them lists of IP ranges
and updating them once in a while, if your ranges change), but why not
dynamically in a custom SAML attribute? That would make OOB exchanges
of those ranges unnecessary and they could dynamically (and data-less)
verify the IP address seen against the IP ranges recieved, on access.

Other than that, the UKfederation had written this extension for IDPv2
https://github.com/ukf/ua-attribute-idp-ext
Seemingly for exactly that same use-case of license holders insisting
on restricting access to certain IP ranges (as if that meant I'm
physically present!) but who at the same time are unwilling to do the
management of IP ranges (per institution) that's needed to do just
that.
-peter