Releasing an attribute based on client IP

[Wessel, Keith]

Peter,

I, too, considered that this would be better handled on the Hathi-Trust side. My wife who used to be a librarian at a small college gave a good case for not doing that, though. Smaller institutions may have everything on campus on privatenet space and NAT outside traffic to a small set of public addresses. Her former employer with about 5,000 students had a single block of 256 for this. Unless a small subnet of that NAT traffic is designated for the library specifically, the vendor will only know that the user is coming from campus, not from the library. Presumably, the IDP will see the privatenet address, though, since it, too, is on campus and can make a more fine-grained decision on the user's physical location.

This is still an odd use case. Whether it's a licensing thing or just makes the lawyers happy, though, I'm starting to see why it might be needed.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Monday, November 23, 2015 7:35 PM
To: users at shibboleth.net
Subject: Re: Releasing an attribute based on client IP

* Wessel, Keith <kwessel at illinois.edu> [2015-11-23 21:32]:
> The folks at Hathi-Trust are asking us to release an attribute on
> login to tell their SP that the logged in user is on a library
> computer (IP range). This, for some reason, seems wrong to me,
> releasing an attribute based on the IP and not the actual user, but
> maybe I'm just not thinking outside the box today.

IMO if they insist on IP checks they should check the IP address
themselfs, against IP ranges you transmit to them somehow. That could
be done out of band (the ordinary way; sending them lists of IP ranges
and updating them once in a while, if your ranges change), but why not
dynamically in a custom SAML attribute? That would make OOB exchanges
of those ranges unnecessary and they could dynamically (and data-less)
verify the IP address seen against the IP ranges recieved, on access.

Other than that, the UKfederation had written this extension for IDPv2
https://github.com/ukf/ua-attribute-idp-ext
Seemingly for exactly that same use-case of license holders insisting
on restricting access to certain IP ranges (as if that meant I'm
physically present!) but who at the same time are unwilling to do the
management of IP ranges (per institution) that's needed to do just
that.
-peter
-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net