Making client IP available to the attribute resolver

[Scott Koranda]

> Thanks, Scott. Your reasoning for adding this to the MFA script instead of the attribute resolver makes sense.
> 
> Can you tell me how I'd instantiate the IPRange class in my MFA script to use it for my comparison?

Hi,

In mfa-authn-config.xml I have defined a <util:map> object like this:

<util:map id="inputForStrategy">
    <entry key="attributeResolver" value-ref="shibboleth.AttributeResolverService"/>
    <entry key="servletRequest" value-ref="shibboleth.HttpServletRequest"/>
</util:map>

Then in the main <bean> I do

// Determine the user IP address
userIpAddressString = custom.get("servletRequest").getRemoteAddr();
logger.debug("{} user IP address is {}", logPrefix, userIpAddressString);

We are using IP address to check for VPN access, so I also have

// Check if user is on the VPN
ipRangeClass = Java.type("net.shibboleth.utilities.java.support.net.IPRange");
vpnRange = ipRangeClass.parseCIDRBlock("192.168.196.0/23");

inetAddressClass = Java.type("java.net.InetAddress");
userIpAddress = inetAddressClass.getByName(userIpAddressString);

if (vpnRange.contains(userIpAddress)) {
  // our logic here...
}

HTH,

Scott K