do not checkAddress in idp-proxy situation for private IPs

[Jehan PROCACCIA]

I hadn't gone that deep in the documentation, I'm glad that this attribute also exist for IDP 

so I've set it in relying-party.xml for our docusign entityIds (we have a prod and dev instances) 

<!-- Container for any overrides you want to add. -->
    <util:list id="shibboleth.RelyingPartyOverrides">
 <bean id="DocuSign" parent="RelyingPartyByName" c:relyingPartyIds="#{{'https://https://account-d.docusign.com/organizations/secret8108/saml2', 'https://account.docusign.com/organizations/secret7004/saml2'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false" p:checkAddress="false" />
                </list>
            </property>
        </bean>

I don't use myself private/NATed address, I'll check with school that do use them to verify if it doesn't break anymore . 

thanks .

----- Mail original -----
De: "Cantor, Scott" <cantor.2 at osu.edu>
À: "users" <users at shibboleth.net>
Envoyé: Lundi 8 Mars 2021 17:16:07
Objet: Re: do not checkAddress in idp-proxy situation for private IPs

Analagous to the SP, there's a checkAddress setting on the SAML2.SSO profile configuration bean.

https://wiki.shibboleth.net/confluence/display/IDP4/SAML2SSOConfiguration#55804373d9264505e7b248218c3ea26c3fd35a11

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net