Making client IP available to the attribute resolver

[Wessel, Keith]

Our security folks have requested that we whitelist an exam facility to bypass MFA for students taking exams who aren't allowed to bring their phones in with them. I'm trying to convince our people to whitelist this IP range with Duo, not in the IdP, as it would bea more comprehensive solution. But if they won't, I'm working on plan B.

First question: is there an easy way to access the client IP in a scripted attribute definition? I presume it's in the request object, but I'm not sure how to get that to my scripted attribute.

My MFA authn configuration script is already setting the principal and relying party ID in the attribute resolution context before resolving the attribute that determines MFA eligibility. It's that same eligibility attribute where I'd like to inject the IP block check.

I see that Geant has an IdP extension for obtaining client IP and passing it through as an attribute for things like walk-in library authentication. I'm hoping to avoid an IdP extension, though, and it seems like there should be an easier way.

Other question: is there any way to take a CIDR and see if a given IP is part of the specified IP range with the tooling available in the attribute resolver? This is, obviously, the other part of the decision once I have the client IP.

Keith