IDP 3.3 - MFA Conditional via IP Address

[Krug, Jeff]

Thanks.  And yes, I will have to do quite a bit of proxy testing and validation before I can consider this adequately secure to justify the convenience, and even so I recognize it's a bit less secure.


-- Jeff



________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Tuesday, June 13, 2017 1:24:49 PM
To: Shib Users
Subject: Re: IDP 3.3 - MFA Conditional via IP Address

On 6/13/17, 1:15 PM, "users on behalf of Krug, Jeff" <users-bounces at shibboleth.net on behalf of Jeff.Krug at gtri.gatech.edu> wrote:

> I am using IDP 3.3 to do MFA with a custom second factor I wrote, but I want to also make the use of the 2nd factor optional
> depending on the IP Address of the user (I have it conditional based on whether they have a 2nd factor configured or not; that
> was easy to do based on the attribute lookup example).

Inject an instance of shibboleth.HttpServletRequest as a custom object into your scripted function.

If you want something fancier, there's already an IPRangePredicate implemented that you could instantiate and use to take most of the work off you. It's used inside the access-control layer so there are examples of the wiring there.

I'd caution that a lot of proxied/load-balanced deployments are probably not providing the address safely (and you're trying to use it for a security control, that's why I mention it).

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170613/d65e5fce/attachment.html>