activationCondition IPRangePredicate

[Philip Brusten]

Hi,

I had some difficulties defining an activationCondition using the 
IPRangePredicate, cf. 
https://wiki.shibboleth.net/confluence/display/IDP30/ActivationConditions#ActivationConditions-ClientAddressRanges

I'm using IdPv3.2.1.

The first two examples ended up in a ConversionNotSupportedException or 
ClassCastException:

# first example:

<!-- Single address range -->
<bean id="MyCondition" class="org.opensaml.profile.logic.IPRangePredicate"
     p:httpServletRequest-ref="shibboleth.HttpServletRequest"
     p:addressRanges="192.168.1.0/24" />


Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name 'MyCondition' defined in file 
[/opt/shibboleth-idp/system/conf/../../conf/authn/general-authn.xml]: 
Initialization of bean failed; nested exception is 
org.springframework.beans.ConversionNotSupportedException: Failed to 
convert property value of type 'java.lang.String' to required type 
'java.lang.Iterable' for property 'addressRanges'; nested exception is 
java.lang.IllegalStateException: Cannot convert value of type 
[java.lang.String] to required type [java.lang.Iterable] for property 
'addressRanges': no matching editors or conversion strategy found


# second example:

<!-- Multiple address ranges -->
<bean id="MyCondition" class="org.opensaml.profile.logic.IPRangePredicate"
     p:httpServletRequest-ref="shibboleth.HttpServletRequest"
     p:addressRanges="#{{'192.168.1.0/24', '192.168.2.0/28'}}" />

Caused by: org.springframework.beans.factory.BeanCreationException: 
Error creating bean with name 'shibboleth.SPNEGO.ActivationCondition' 
defined in file 
[/opt/shibboleth-idp/system/conf/../../conf/authn/general-authn.xml]: 
Error setting property values; nested exception is 
org.springframework.beans.PropertyBatchUpdateException; nested 
PropertyAccessExceptions (1) are:
PropertyAccessException 1: 
org.springframework.beans.TypeMismatchException: Failed to convert 
property value of type 
'java.util.Collections$UnmodifiableRandomAccessList' to required type 
'java.lang.Iterable' for property 'addressRanges'; nested exception is 
java.lang.ClassCastException: java.lang.String cannot be cast to 
net.shibboleth.utilities.java.support.net.IPRange


# third example was missing a util:list-wrapper with a value-type, when 
I changed it to this, it worked:

     <bean id="MyCondition" 
class="org.opensaml.profile.logic.IPRangePredicate"
p:httpServletRequest-ref="shibboleth.HttpServletRequest">
     <property name="addressRanges">
         <util:list 
value-type="net.shibboleth.utilities.java.support.net.IPRange">
             <value>192.168.1.0/24</value>
             <value>192.168.2.0/28</value>
         </util:list>
     </property>

Since I'm not that familiar with the SpEL-syntax, I could not get 
example 1 & 2 working...

We are running the IdP behind a loadbalancer which injects the original 
IP in a custom HTTP-header, so we will need to evaluate that custom 
header instead of request.getRemoteAddr().
This would be a nice add-on to this predicate function.

Is there an easy way to import that list from a properties-file?

Kr,

Philip