IDP, for specific SP block IDP use/access except from specific IP addresses ....

[Cantor, Scott]

On 1/31/18, 4:04 PM, "users on behalf of Steven Carmody" <users-bounces at shibboleth.net on behalf of steven_carmody at brown.edu> wrote:

>  I didn't think it would be possible to construct a firewall/web server 
> rule in front of an IDP that says "if the destination SP entityID = X 
> then only allow requests from IP addr= Y".

I missed the "specific SP" part of that subject line. That's a use case for the context-check interceptor flow that already comes with the software, provided it's acceptable to do it after authentication. If you have to block it before that happens, it could be done if necessary though it has to then be enabled with a bit of care we haven't documented at the moment.

The context-check flow is actually pretty "timing neutral" because of how it operates, so it could in theory be enabled at any of the three interceptor points that are allowed.
 
-- Scott