Using an activation condition with a MFA transition map

[Cantor, Scott]

On 9/19/19, 4:02 AM, "users on behalf of Guillaume Rousse" <users-bounces at shibboleth.net on behalf of guillaume.rousse at renater.fr> wrote:

> Next question: the current implementation of IPRangePredicate compares 
> the source address of an HTTP request with a set of network ranges. What 
> would be the best way to use the X-Forwarded-For header instead for this 
> comparaison, so as to make it usable from behind a reverse-proxy ?

A correctly configured web server will provide the that value in the proper place so the API to get the client's address returns it.

-- Scott