Making client IP available to the attribute resolver

[Cantor, Scott]

> First question: is there an easy way to access the client IP in a scripted
> attribute definition? I presume it's in the request object, but I'm not sure
> how to get that to my scripted attribute.

Inject the bean named shibboleth.HttpServletRequest and you have the servlet request where getRemoteAddr lives. But be aware that won't work on the back channel, which is something that may not matter for SAML but is increasingly a problem in the future if the OIDC work pushes people to go backwards and start using that again. In other words, I wouldn't do this in the resolver. During authentication of course is fine.

> My MFA authn configuration script is already setting the principal and relying
> party ID in the attribute resolution context before resolving the attribute that
> determines MFA eligibility. It's that same eligibility attribute where I'd like to
> inject the IP block check.

You may want to pull that part of the check up into the MFA scripting.

> Other question: is there any way to take a CIDR and see if a given IP is part of
> the specified IP range with the tooling available in the attribute resolver? This
> is, obviously, the other part of the decision once I have the client IP.

We have an IPRange class in the java-support library.

-- Scott