Making client IP available to the attribute resolver

[Wessel, Keith]

Thanks, Scott. Your reasoning for adding this to the MFA script instead of the attribute resolver makes sense.

Can you tell me how I'd instantiate the IPRange class in my MFA script to use it for my comparison?

Thanks,
Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Tuesday, April 17, 2018 9:53 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: Making client IP available to the attribute resolver

> First question: is there an easy way to access the client IP in a 
> scripted attribute definition? I presume it's in the request object, 
> but I'm not sure how to get that to my scripted attribute.

Inject the bean named shibboleth.HttpServletRequest and you have the servlet request where getRemoteAddr lives. But be aware that won't work on the back channel, which is something that may not matter for SAML but is increasingly a problem in the future if the OIDC work pushes people to go backwards and start using that again. In other words, I wouldn't do this in the resolver. During authentication of course is fine.

> My MFA authn configuration script is already setting the principal and 
> relying party ID in the attribute resolution context before resolving 
> the attribute that determines MFA eligibility. It's that same 
> eligibility attribute where I'd like to inject the IP block check.

You may want to pull that part of the check up into the MFA scripting.

> Other question: is there any way to take a CIDR and see if a given IP 
> is part of the specified IP range with the tooling available in the 
> attribute resolver? This is, obviously, the other part of the decision once I have the client IP.

We have an IPRange class in the java-support library.

-- Scott

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net