session id and ip address

[Guillaume Rousse]

Le 02/05/2018 à 17:53, Cantor, Scott a écrit :
> On 5/2/18, 11:47 AM, "users on behalf of Bryan K. Walton" <users-bounces at shibboleth.net on behalf of bwalton+1525274800 at leepfrog.com> wrote:
> 
>> Is this possible with Shibboleth?
> 
> No, checking is either on or off.
> 
> I have given some thought to it (more with the IdP in mind) but it isn't terribly obvious how one could express a configuration that would make any sense and I tend to think it's an application responsibility to do something that odd. The SP is complex enough (and then some).
I may have misunderstood, but if the adress change only occurs between 
authentication stage (ie, on the IdP) and service access (ie, on the 
SP), and then stay constant during all the SP session, the 
'consistentAddress' parameter may be used to implement such kind of 
relaxed check.

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20180502/a6d51c72/attachment.p7s>