allow automated access through an SP from a single host

[Cantor, Scott]

> We've recently protected a web application in a testing environment with
> This is the first time I've encountered this use case, so I'm unfamiliar with the
> options. It doesn't seem possible to create a configuration to actually bypass
> authentication, so I assume we need to look for options to provide some
> form of automated authentication.

Apache can quite easily allow specific addresses in, so you should be able to manipulate things there. Alternatively you just set up separate URLs, and or alternatively to that, you can let the application dictate when the session gets established and just leave requireSession off.

> Based on what I've read in the wiki
> documentation thus far, it seems we could configure IP-based authentication
> using conf/authn/ipaddress-authn-config.xml, or perhaps x509
> authentication using conf/authn/x509-authn-config.xml. I also read with
> interest a post to this list in Oct 2016 where Scott referred to attribute
> release based on IP address.

None of that is appropriate unless you start talking about ECP, which you're not going to do. You should never screen scrape browser flows.

> My initial question is how best to approach the problem where an external
> web app requires automated access to a protected URL, but where users
> also require password authentication. Should this be done by the IdP, or is it
> actually possible to essentially whitelist a host at the SP based on source IP
> address? I'd definitely like to keep this as simple and straightforward as
> possible.

Not in the SP, in the web server/application/etc. But not at the IdP, no.

-- Scott