do not checkAddress in idp-proxy situation for private IPs

[Jehan PROCACCIA]

Hello, 

recently, (thanks to the list!), I enabled IDP-proxying for DocuSign SP , cf : https://marc.info/?t=161193758600001&r=1&w=2 
Now , although everyhting works fine for most of the IDPs behind the IDP-Proxy , some clients that uses private IPs + NAT cannot complete the SSO+attributes complete process . 
I suspect that in the long workflow of redirects , they hit a missmatch between the browser private IP @ and the one NATed viewed by the SP and /or Proxy ... 
I found the in the SP doc: [ https://wiki.shibboleth.net/confluence/display/SP3/Sessions | https://wiki.shibboleth.net/confluence/display/SP3/Sessions ] the checkAddress attribute that might be the "culprit" ? 
but this is a SP attribute , how can I tell my IDP-Proxy that act as a SP for 2nd hand IDPs not to checkaddresses ? (if this is the real culprit ? ) 

thanks 


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210308/1926267f/attachment.htm>