Making client IP available to the attribute resolver

[Wessel, Keith]

Thanks, Scott and Scott.

Scott K, excellent example that made my job super easy. You might want to consider contributing it to the MFA config page on the wiki.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Scott Koranda
Sent: Tuesday, April 17, 2018 11:31 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Making client IP available to the attribute resolver

> Thanks, Scott. Your reasoning for adding this to the MFA script instead of the attribute resolver makes sense.
> 
> Can you tell me how I'd instantiate the IPRange class in my MFA script to use it for my comparison?

Hi,

In mfa-authn-config.xml I have defined a <util:map> object like this:

<util:map id="inputForStrategy">
    <entry key="attributeResolver" value-ref="shibboleth.AttributeResolverService"/>
    <entry key="servletRequest" value-ref="shibboleth.HttpServletRequest"/>
</util:map>

Then in the main <bean> I do

// Determine the user IP address
userIpAddressString = custom.get("servletRequest").getRemoteAddr();
logger.debug("{} user IP address is {}", logPrefix, userIpAddressString);

We are using IP address to check for VPN access, so I also have

// Check if user is on the VPN
ipRangeClass = Java.type("net.shibboleth.utilities.java.support.net.IPRange");
vpnRange = ipRangeClass.parseCIDRBlock("192.168.196.0/23");

inetAddressClass = Java.type("java.net.InetAddress");
userIpAddress = inetAddressClass.getByName(userIpAddressString);

if (vpnRange.contains(userIpAddress)) {
  // our logic here...
}

HTH,

Scott K
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net