SP 2.x doesn't respect consistentAddress="false" setting

[Luo, Pan]

Hi,

I have SP behind a SNAT network. The client address (SNAT) are different every time. I've set consistentAddress="false" in /etc/shibboleth/shibboleth2.xml like below:

<Sessions lifetime="7200" timeout="3600" checkAddress="false" consistentAddress="false" ...

but still seeing the following warning messages in the native.log

2017-08-29 17:45:28 WARN Shibboleth.SessionCache [2389] shib_check_user: client address mismatch, client (10.19.170.30), session (10.19.170.31)
2017-08-29 17:45:28 WARN Shibboleth.ServiceProvider [2389] shib_check_user: error during session lookup: Your IP address (10.19.170.30) does not match the address recorded at the time the session was established.
2017-08-29 17:45:31 WARN Shibboleth.SessionCache [2401] shib_check_user: client address mismatch, client (10.19.170.32), session (10.19.170.30)
2017-08-29 17:45:31 WARN Shibboleth.ServiceProvider [2401] shib_check_user: error during session lookup: Your IP address (10.19.170.32) does not match the address recorded at the time the session was established.

Also, when there is warning message like this, user session was removed and user are logged out. I've tested it on SP 2.6.0 and 2.5.3. Any suggestion? Thanks.

Cheers,
Pan