activationCondition IPRangePredicate

[Philip Brusten]

On 27/09/2016 17:38, Cantor, Scott wrote:
>>     We are running the IdP behind a loadbalancer which injects the original
>>     IP in a custom HTTP-header, so we will need to evaluate that custom
>>     header instead of request.getRemoteAddr().
>>     This would be a nice add-on to this predicate function.
> Our position is that that needs to be handled in your container. Otherwise we would have to implement it in every possible place, that's just not practical.
>
> Most containers either support this out of the box, have add-on filters that work, or it's easy to write one.
Ok, I've added this to my jetty-ssl.xml and now it works, thanks for the 
tip!

   <New id="sslHttpConfig" 
class="org.eclipse.jetty.server.HttpConfiguration">
     <Arg><Ref refid="httpConfig"/></Arg>
     <Call name="addCustomizer">
       <Arg>
         <New class="org.eclipse.jetty.server.SecureRequestCustomizer">
           <Arg name="sniHostCheck" type="boolean"><Property 
name="jetty.ssl.sniHostCheck" default="true"/></Arg>
           <Arg name="stsMaxAgeSeconds" type="int"><Property 
name="jetty.ssl.stsMaxAgeSeconds" default="-1"/></Arg>
           <Arg name="stsIncludeSubdomains" type="boolean"><Property 
name="jetty.ssl.stsIncludeSubdomains" default="false"/></Arg>
         </New>
       </Arg>
     </Call>
+    <Call name="addCustomizer">
+      <Arg>
+        <New class="org.eclipse.jetty.server.ForwardedRequestCustomizer">
+            <Set name="forwardedHostHeader"><Property 
name="jetty.httpConfig.forwardedHostHeader" 
default="X-Forwarded-Host"/></Set>
+            <Set name="forwardedServerHeader"><Property 
name="jetty.httpConfig.forwardedServerHeader" 
default="X-Forwarded-Server"/></Set>
+            <Set name="forwardedProtoHeader"><Property 
name="jetty.httpConfig.forwardedProtoHeader" 
default="X-Forwarded-Proto"/></Set>
+            <Set name="forwardedForHeader"><Property 
name="jetty.httpConfig.forwardedForHeader" default="X-Forwarded-For"/></Set>
+            <Set name="forwardedSslSessionIdHeader"><Property 
name="jetty.httpConfig.forwardedSslSessionIdHeader" /></Set>
+            <Set name="forwardedCipherSuiteHeader"><Property 
name="jetty.httpConfig.forwardedCipherSuiteHeader" /></Set>
+        </New>
+      </Arg>
+    </Call>
   </New>


Is it possible to add the result of this predicate to a view element, so 
I would be able to use the result in our UI?
The use case for which I would like to use this:
I added this IPRangePredicate as an activationCondition to our SPNEGO 
authN module. Now I want use that same condition to determine if the 
checkbox, which sets the _idp_spnego_autologin-cookie, should be shown 
to the user.
I don't want to annoy people with this checkbox if they are unable to 
perform the SPNEGO-login anyway.

Thx,

Philip