activationCondition IPRangePredicate

[Philip Brusten]

On 29/09/2016 17:21, Cantor, Scott wrote:
> On 9/29/16, 10:21 AM, "users on behalf of Philip Brusten" <users-bounces at shibboleth.net on behalf of philip.brusten at kuleuven.be> wrote:
>> Ok, I've added this to my jetty-ssl.xml and now it works, thanks for the tip!
> Is that shown anywhere explicitly in the Jetty documentation or did you have to figure it out?
Well, I could not get it working by enabling the default module 
http-forwarded in Jetty 9.3.
jetty-https uses the sslHttpConfig from jetty-ssl.xml.
Although sslHttpConfig inherits from httpConfig, and by enabling the 
http-forwarded you configure the httpConfig-configuration, it still did 
not work...

When I enabled the http-server, it worked, but not yet on the https-server.

So I added another customizer within that HttpConfiguration of 
sslHttpConfig and than it worked.

>
>> Is it possible to add the result of this predicate to a view element, so
>> I would be able to use the result in our UI?
> Add it as a custom object to the views, see https://wiki.shibboleth.net/confluence/display/IDP30/VelocityVariables
>
> "custom"

I added this to global.xml

<util:map id="shibboleth.CustomViewContext">
   <entry key="IPRangePredicate" 
value-ref="shibboleth.SPNEGO.ActivationCondition"/>
</util:map>
<bean id="shibboleth.SPNEGO.ActivationCondition" 
class="org.opensaml.profile.logic.IPRangePredicate"
p:httpServletRequest-ref="shibboleth.HttpServletRequest">
     <property name="addressRanges">
         <util:list 
value-type="net.shibboleth.utilities.java.support.net.IPRange">
                 <value>10.0.0.0/8</value>
                 <value>192.0.0.0/16</value>
         </util:list>
     </property>
</bean>

And this to my login.vm

#set ($IPRangePredicate = $custom["IPRangePredicate"])

<strong>$request.getRemoteAddr()</strong><br>
<strong>$IPRangePredicate.getClass()</strong><br>
#if ($IPRangePredicate.apply() )
  <strong>Ok</strong><br>
#else
  <strong>Not ok</strong><br>
#end

The apply()-method did nothing for me... Always returned false.

"10.1.0.24
class org.opensaml.profile.logic.IPRangePredicate
Not ok"

Any pointers on how to debug this?

Thx,

Philip