Remove Address from SubjectConfirmationData

[Plovich, Tony]

Hello,

I'm attempting to federate with a broken SP that isn't seeing the correct client source for the the Address attribute in SubjectConfirmationData.  Watching the assertion, Address is set correctly, but their logs say it's a mismatch.  I'm thinking their ACS is located behind a load-balancer / reverse proxy that's changing the client's source IP.  They claim the other IDPs they've federated with don't populate Address.

Is there a way within Shibboleth to prevent Address from being added to the SubjectConfirmationData?  My searches of the wiki haven't turned anything up, except the checkAddress RP profile config (https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11).  However, this appears to be for messages coming into the IDP, not leaving.

I get that this is in place to prevent someone from hijacking your assertion and SP session, but I need to investigate whether this can be done regardless.

Thanks,
Tony Plovich

Business Information Systems
Argonne National Laboratory

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210205/b1384d34/attachment.htm>