SP error - client address differs

[Cantor, Scott]

On 3/30/17, 10:47 PM, "users on behalf of Jeff McCullough" <users-bounces at shibboleth.net on behalf of jeffmc at berkeley.edu> wrote:

> I’m confident that the IP is the same though. 

It is, quite simply, not. The log will prove that.
 
> I searched and found some references to checkAddress config change in the SP, but am wondering if there may be something I
> can change on the IDP to work around the issue.

Only if the cause is a misconfigured IdP that's not getting accurate client address information and the SP is.

> We upgraded 2.3.8 to 3.3.1, and their config did work with the previous version.

That suggests your IdP is now deployed improperly, but that's a function of container architecture and deployment and would impact many/most/all SPs doing that check, though in practice most do not implement that check. I have very little to go on since I know nothing about the scope of your deployment and use and how likely it would be noticed.
 
-- Scott