SP 2.x doesn't respect consistentAddress="false" setting
Mark Vinkx
mark.vinkx at uzleuven.be
Wed Sep 20 10:23:55 EDT 2017
I do think I am facing the same problem. For the shibboleth serviceprovide my client IP adres is sometimes 10.1.15.1 and sometimes 10.1.10.1
Setting consistentAddress="false" checkAddress="false" does not disable the checking of the client IP address and a the existing session is not accepted
2017-09-20 06:53:57 WARN Shibboleth.SessionCache [20] shib_check_user: client address mismatch, client (10.1.10.1), session (10.1.15.1)
2017-09-20 06:53:57 WARN Shibboleth.ServiceProvider [20] shib_check_user: error during session lookup: Your IP address (10.1.10.1) does not match the address recorded at the time the session was established.
I tried using the REMOTE_ADDR setting but then I get in a loop between SP and our adfs IDP.
I added the to my apache config
RequestHeader set uzl_shib_session_ip "10.254.3.222"
<Location / >
ShibRequestSetting REMOTE_ADDR uzl_shib_session_ip
</location>
The correct client IP is used ClientAddress: 10.254.3.222
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: New session (ID: _6145cf18b3fb7bba09a9fd2b800c3d79) with (applicationId: default) for principal from (IdP: http://sts.uzleuven.be/adfs/services/trust) at (ClientAddress: 10.254.3.222) with (NameIdentifier: xxxx) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _78e24913-a196-41db-862f-e5329f73d59b)
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: Cached the following attributes with session (ID: _6145cf18b3fb7bba09a9fd2b800c3d79) for (applicationId: default) {
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: groups (362 values)
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: loginnaam (1 values)
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: }
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: New session (ID: _2b32e4f2d15363db7267e91f89be733b) with (applicationId: default) for principal from (IdP: http://sts.uzleuven.be/adfs/services/trust) at (ClientAddress: 10.254.3.222) with (NameIdentifier: xxxx) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: _501f26c6-4a40-40a3-ab59-15fb28ed8d23)
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: Cached the following attributes with session (ID: _2b32e4f2d15363db7267e91f89be733b) for (applicationId: default) {
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: groups (362 values)
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: loginnaam (1 values)
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: }
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: New session (ID: ) with (applicationId: default) for principal from (IdP: http://sts.uzleuven.be/adfs/services/trust) at (ClientAddress: 10.254.3.222) with (NameIdentifier: none) using (Protocol: urn:oasis:names:tc:SAML:2.0:protocol) from (AssertionID: )
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: Cached the following attributes with session (ID: ) for (applicationId: default) {
2017-09-20 14:15:17 INFO Shibboleth-TRANSACTION [3]: }
More information about the users
mailing list