do not checkAddress in idp-proxy situation for private IPs

[Jehan PROCACCIA]

Ok , from examples in the doc: https://wiki.shibboleth.net/confluence/display/IDP4/RelyingPartyConfiguration
I understand that I can specify the checkAddress attribute only for those "2nd Hand/backends" IDPs of my idp-proxy by listing them specifically :

<util:list id="shibboleth.RelyingPartyOverrides">
 <bean id="proxyBackendIdps" parent="RelyingPartyByName">
                 <constructor-arg name="relyingPartyIds">
                <list>
                        <value>https://idp.school1.fr/idp/shibboleth</value>
                        <value>https://idp.school2.fr/idp/shibboleth</value>
                        <value>https://multipass.school3.fr/idp/shibboleth</value>
                </list>
                </constructor-arg>
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:checkAddress="false" />
                </list></property> </bean> </util:list>

I hope this time it's the right/best way to do it, We'll give it a try . 

thanks

Ps: by the way, in the doc your example fails on a xml mismatched tag, indeed there's
<!-- Example matching three (or more) SPs -->
<bean parent="RelyingPartyByName">
    <constructor-arg name="relyingPartyIds">
....
 </constructor>
=> it shoud be </constructor-arg> .


----- Mail original -----
De: "Cantor, Scott" <cantor.2 at osu.edu>
À: "users" <users at shibboleth.net>
Envoyé: Lundi 8 Mars 2021 21:08:02
Objet: Re: do not checkAddress in idp-proxy situation for private IPs

On 3/8/21, 3:01 PM, "users on behalf of Jehan PROCACCIA" <users-bounces at shibboleth.net on behalf of jehan.procaccia at tem-tsp.eu> wrote:

>    so should I apply the setting in the DefaultRelyingParty ? 

Anywhere you want, but if it doesn't apply to the requests that are checking it then it won't do anything.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net