Question on ShibbolethSP 2.5.3 | AddressChecking | consistentAddress

[don ingratta]

We've seen this with users from at least two of our client accounts - after
establishing a Shibboleth session, their Shibboleth session is closed
because the end user's IP (client source IP) has changed during the
Shibboleth session resulting in the blocking of subsequent requests to our
web application (because the requests are being redirected to login and
causing our pages to not load correctly and making our website unusable
from that point on).

We're getting push back from one of these client accounts to disable the
consistentAddress check as their network is setup to behave as follows:

They use multiple NAT IPs in total on their side and sessions will be going
out through them. From their side, they cannot restrict communication to go
out using only one IP.  As a result they are asking us to disable the IP
tagging for sessions which will resolve their access problems to our web
application.

We understand the purpose of the consistentAddress feature and how it
improves security in the shibboleth-sp. I have a couple of questions that
I'm looking for some feedback from this community.

1)  Is this client's network behavior in this case becoming more common
place these days in computer networks and is it a growing trend, making the
consistentAddress check obsolete or would use say it is not normal (maybe
going as far saying it is unorthodox and a bad practice) and not the case
where the consistentAddress check is non longer relevant.

2) How important on a scale of 1 to 10 of increasing importance, would you
say having the consistentAddress check enabled would rank in the security
of the shibboleth-sp.

3) What security risks, concerns and vulnerabilities would exist by having
the consistentAddress check disabled in shibboleth-sp?

4) Are the security risks/concerns justification enough to justify a
security policy of requiring end users to maintain a consistent IP as part
of a user agreement for use of an application wjhich uses shibboleth-sp.

Thanks in advance,

Don
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170302/24f50c26/attachment.html>