IDP, for specific SP block IDP use/access except from specific IP addresses ....

[Steven Carmody]

On 1/31/18 12:33 PM, Cantor, Scott wrote:
> On 1/31/18, 11:51 AM, "users on behalf of Steven Carmody" <users-bounces at shibboleth.net on behalf of steven_carmody at brown.edu> wrote:
> 
>>   it looks like this might be a specific example of an "intercept" flow
>> within the IDP ? Or is there a better way to do this ? Is there already
>> a way of configuring this into the IDP ?
> 
> It really depends what somebody wants to happen, and I would probably tend to do it by just configuring firewall or web server rules, that's not really something applications are meant to be screwing around with.
> 

I didn't think it would be possible to construct a firewall/web server 
rule in front of an IDP that says "if the destination SP entityID = X 
then only allow requests from IP addr= Y".

It seemed to me that the IDP would be  in a much better position to have 
both the SP entityID value and the browser IP address .....