IDP 3.3 - MFA Conditional via IP Address

[Cantor, Scott]

On 6/13/17, 1:15 PM, "users on behalf of Krug, Jeff" <users-bounces at shibboleth.net on behalf of Jeff.Krug at gtri.gatech.edu> wrote:

> I am using IDP 3.3 to do MFA with a custom second factor I wrote, but I want to also make the use of the 2nd factor optional
> depending on the IP Address of the user (I have it conditional based on whether they have a 2nd factor configured or not; that
> was easy to do based on the attribute lookup example).  

Inject an instance of shibboleth.HttpServletRequest as a custom object into your scripted function.

If you want something fancier, there's already an IPRangePredicate implemented that you could instantiate and use to take most of the work off you. It's used inside the access-control layer so there are examples of the wiring there.

I'd caution that a lot of proxied/load-balanced deployments are probably not providing the address safely (and you're trying to use it for a security control, that's why I mention it).

-- Scott