IP range protection and IT accounts for external users

[Peter Schober]

* Morrow, David <d.morrow at abdn.ac.uk> [2016-08-31 10:12]:
> Currently we provide IT accounts for external contractors and
> temporary guests to the University. The accounts reside in a
> specific AD OU which is denied to the LDAP account used by
> Shibboleth to stop access to resources which use LDAP
> authentication.

You could also consider giving them access to Shibboleth-protected
resources (by means of allowing the LDAP search-bind account to find
them), but taking care they don't get any attributes they shouldn't
get. Authorisation should be the resource's task, after all, which is
what attributes are for.

> However, some e-journal sites use IP address range only for
> validation. Can I  ask how other institutions deal with their
> "external" users and access to IP range protected resources?
> Apologies if this is the wrong list.

If you're asking "How do I stop people on my local network from
accessing resources they're not entitled to?", where the resource only
checks for the client's IP address, by definition Shibboleth has no
role in this: It all depends on how you manage your local network and
assignment of IP addresses (plus the ranges you consider authorised
you communicate to the resource provider).

Many large networks have not been built with this kind of flexibility
(or misuse, if you will) in mind. So far at least my employer has
managed to avoid assigning people into different VLANs (different IP
ranges for different "affiliations") depending on the role someone has
within the institution -- even though that has been requested in the
past, both by local library folks and resource providers. Instead, if
you want such fine-grained authorisation, don't rely on IP addresses
at all, and use SAML attributes for authorisation to that resource
only.

Of course there's a trade-off between ease of use for people on-site
(transparent access, without having to log in) vs. how badly you need
to avoid those other affiliations getting access to licensed resources
(risk of ligitation).
Also, the fact that more people not only bring their own device to
work, these days, but also their own network (GSM), should actually
help in moving away from IP ranges as the sole/main criterion for
access control purposes.

-peter