Client Authentication issue from NAT POOL

[Kevin Foote]

> On Jan 13, 2016, at 9:34 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 1/13/16, 12:06 PM, "users on behalf of AdamhEdTech" <users-bounces at shibboleth.net on behalf of adam.henderson at nassau.k12.fl.us> wrote:
> 
>> 
>> Well you are right, I cant see layer 7 in wireshark but I see a SYN, SYN ACK
>> and an ACK so I assume a session is started. 
> 
> That's a TCP session. We're talking about a web application and session means something completely  different there obviously. You can have a million TCP sessions but they're all one session with the web application because the cookie is the same. That cookie is bound to an IP address for security.
> 
>> NAT may be evil but pretty hard to avoid with 13k daily users and over 100k
>> connections made at any given time.
> 
> If you asked me to allow for that in my IdP, I wouldn't even consider it. Other people are entirely welcome to make their own decisions about their IdP's security.
> 
> Does make for a fascinating case study in the whole question of IdP trustworthiness and assurance and such. If I knew an IdP was allowing unbound session cookies, I'd want to know that as an SP. ;-)

Just curious… 

Along these same thread lines how does ipv6 privacy extensions [1] play into this? 
Mostly curious as I have been thrown into local ipv6 discussions - ugh. Which consequently has lead to a confusing amount of reading on my end. :( 

[1] https://tools.ietf.org/html/rfc4941

--------
thanks
 kevin.foote